CVE-2026-77524

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-77524

The KEDA (Kubernetes-based Event Driven Autoscaling) component is vulnerable to privilege escalation in versions 2.20.2 and earlier . A namespace administrator with permissions to create TriggerAuthentication and ScaledObject resources can configure a tenant-controlled endpoint for hashiCorpVault...

CVE-2026-77524 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

EUVD-2026-101431

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-107386 vulnerabilities

Vulnerabilities for packages: trufflehog-fips, bento, falcosidekick-fips, guac, krakend-fips, keda, argo-events-fips, telegraf, falcosidekick, bento-fips, krakend, argo-events, trufflehog, keda-fips...

GHSA-W6R9-248C-FRG8 vulnerabilities

Vulnerabilities for packages: trufflehog-fips, bento, falcosidekick-fips, guac, krakend-fips, keda, argo-events-fips, telegraf, falcosidekick, bento-fips, krakend, argo-events, trufflehog, keda-fips...

CVE-2026-107386 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac, bento, argo-events, telegraf, trufflehog, keda...

GHSA-W6R9-248C-FRG8 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac, bento, argo-events, telegraf, trufflehog, keda...

AZL-107613 CVE-2026-97032 affecting package keda 2.14.1-19

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107607 CVE-2026-78669 affecting package keda 2.14.1-19

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107601 CVE-2026-78659 affecting package keda 2.14.1-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107598 CVE-2026-78660 affecting package keda 2.14.1-19

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107616 CVE-2026-78663 affecting package keda 2.14.1-19

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107595 CVE-2026-107325 affecting package keda 2.14.1-19

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

AZL-107604 CVE-2026-107324 affecting package keda 2.14.1-19

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

AZL-107610 CVE-2026-56851 affecting package keda 2.14.1-19

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

CVE-2026-37236 affecting package keda for versions less than 2.14.1-19

CVE-2026-37236 affecting package keda for versions less than 2.14.1-19. A patched version of the package is available...

AZL-105534 CVE-2026-63209 affecting package keda 2.14.1-19

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently...

CLEANSTART-2026-TL78723 Security fix for CVE-2025-68156 applied in: argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, eks-distro-coredns-fips 1.35.7-r0, keda 2.17.2-r2, keda 2.18.3-r0, tempo-fips 2.7.2-r0

CVE-2025-68156 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VL17238 Security fix for CVE-2026-33815 applied in: argo-workflows 4.0.4-r1, cloudnative-pg 1.26.3-r1, cloudnative-pg-fips 1.25.4-r4, cloudnative-pg-fips 1.27.3-r3, cloudnative-pg-fips 1.28.1-r3, jitsucom-bulker 2.10.0-r2, jitsucom-bulker 2.11.0-r1, jitsucom-bulker 2.8.6-r0, jitsucom-bulker 2.9.0-r0, keda 2.19.0-r3, keda-fips 2.18.3-r3, kube-bench 0.15.0-r0, openbao-fips 2.3.2-r6, openbao-fips 2.4.4-r6, step 0.29.0-r0, step 0.30.2-r1, step-cli 0.27.5-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, temporal 1.5.1-r0, temporal-server 1.29.6-r0, temporal-server 1.30.4-r0, temporal-server 1.31.0.153.3-r0, temporal-server-fips 1.29.6-r0, temporal-server-fips 1.31.0.153.1-r0

CVE-2026-33815 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...