keda vulnerabilities

2 known vulnerabilities in keda from Kedacore. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  keda: Improper Privilege Management

  CVE-2026-77524Oct 14, 2026Kedacore

  KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Ku

• 8.2 High severity

  keda: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-68476Dec 22, 2025Kedacore

  KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp