GO-2026-6776 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent-fips, kserve, kserve-localmodelnode-agent, kserve-fips, keda-http-add-on, keda-http-add-on-fips, k8sgpt...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: dapr, dapr-fips, telegraf, keda-fips, keda, trufflehog-fips, guac, argo-events-fips, argo-events, krakend-fips, krakend, bento-fips, trufflehog, falcosidekick-fips, falcosidekick, bento...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: falcosidekick, argo-events, bento, guac, telegraf, trufflehog, keda...

GO-2026-6776 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...

PT-2026-118074

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...

CVE-2026-78669 affecting package keda for versions less than 2.14.1-22

CVE-2026-78669 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78663 affecting package keda for versions less than 2.14.1-22

CVE-2026-78663 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78659 affecting package keda for versions less than 2.14.1-22

CVE-2026-78659 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-97032 affecting package keda for versions less than 2.14.1-22

CVE-2026-97032 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-107324 affecting package keda for versions less than 2.14.1-22

CVE-2026-107324 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-78660 affecting package keda for versions less than 2.14.1-22

CVE-2026-78660 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

CVE-2026-107325 affecting package keda for versions less than 2.14.1-22

CVE-2026-107325 affecting package keda for versions less than 2.14.1-22. A patched version of the package is available...

GHSA-637C-6JXX-4RWM vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent-fips, kserve, kserve-localmodelnode-agent, kserve-fips, keda-http-add-on, keda-http-add-on-fips, k8sgpt...

CVE-2026-77524 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent-fips, kserve, kserve-localmodelnode-agent, kserve-fips, keda-http-add-on, keda-http-add-on-fips, k8sgpt...

GHSA-637C-6JXX-4RWM KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...

EUVD-2026-101431

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication...

CVE-2026-77524

A flaw was found in KEDA. An authenticated user with permission to create autoscaling resources can configure a HashiCorp Vault endpoint pointing to an attacker-controlled server without providing credentials. KEDA then forwards the operator's internal Kubernetes service account token to that...

AZL-108090 CVE-2026-77524 affecting package keda 2.14.1-19

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...

CVE-2026-77524

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an...