CVE-2026-77524

Executive Summary

CVE-2026-77524 is a privilege escalation vulnerability in KEDA (Kubernetes Event Driven Autoscaling) affecting version 2.20.2 and earlier. A namespace administrator with permissions to create TriggerAuthentication and ScaledObject resources can redirect the KEDA operator's HashiCorp Vault authentication to an attacker-controlled endpoint, causing the operator's projected ServiceAccount token to be exfiltrated and used to obtain the operator's cluster-wide privileges. With a CVSS score of 9.9, successful exploitation grants broad Secret read access and workload or admission-related operations across the cluster.

Technical Analysis

KEDA is a Kubernetes-based Event Driven Autoscaling component that scales workloads based on external event sources. To authenticate to external event sources such as HashiCorp Vault, KEDA supports authentication through TriggerAuthentication resources, which can be referenced by ScaledObject resources. This design allows namespace-scoped administrators to influence how the KEDA operator authenticates to external systems.

The vulnerability class here is CWE-269 (Improper Privilege Management), specifically a confused-deputy / credential-forwarding flaw. The attack relies on the following mechanism described in the NVD entry: a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set the hashiCorpVault.address field to a tenant-controlled endpoint, and can select Kubernetes authentication without providing an explicit credential. When this configuration is processed, KEDA falls back to using the operator pod's projected ServiceAccount token and transmits that token to the attacker-controlled endpoint as a Vault login credential.

The critical enabling condition is that a JWT-shape filter introduced as a remediation for the prior CVE-2025-68476 does not reject the operator's ServiceAccount token. Because the token's subject is a Kubernetes ServiceAccount, it passes the JWT-shape filter and is accepted. This means the mitigation designed to prevent credential misuse for the prior CVE does not cover the operator's own identity — the filter validates token shape and subject characteristics, but does not distinguish between a legitimate external credential and the operator's own projected token when the endpoint is attacker-controlled.

From an attack surface perspective, the vulnerable inputs are the hashiCorpVault.address field and the Kubernetes authentication selection within TriggerAuthentication, combined with a ScaledObject that references it. There is no user interaction requirement and no authentication complexity beyond the namespace-administrator role (PR:L). The scope is changed (S:C) because the KEDA operator, which runs with cluster-wide permissions, is compromised through a namespace-scoped resource creation primitive. Confidentiality, integrity, and availability impacts are all rated High, reflecting that the operator's elevated permissions include broad Secret reads and workload or admission-related operations.

At the code level, the flaw is a failure of trust-boundary enforcement: tenant-controlled configuration data (the Vault address) is allowed to influence where the operator's own identity credential is sent. The JWT-shape filter is a second-order control that was not designed to prevent the operator's own token from being relayed to a hostile endpoint. No further implementation specifics — function names, file paths, or internal API parameters — are available in the provided data, and none are inferred here.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class and the authorized description.

1. Reconnaissance / target identification. The attacker requires the ability to create or modify resources within a Kubernetes namespace managed by a KEDA installation running version 2.20.2 or earlier. The attacker identifies that KEDA is deployed and that they hold namespace-admin privileges sufficient to create TriggerAuthentication and ScaledObject resources. No external port scanning or DNS enumeration of the KEDA operator is required; access is via the Kubernetes API server.

2. Triggering the flaw class. The attacker creates a TriggerAuthentication resource configured for HashiCorp Vault authentication, setting hashiCorpVault.address to an endpoint they control, and selecting Kubernetes authentication without supplying an explicit credential. They then create or modify a ScaledObject that references this TriggerAuthentication. This causes KEDA to resolve the Vault address to the attacker's endpoint and, due to the absence of an explicit credential, to fall back to the operator pod's projected ServiceAccount token.

3. Payload / execution method (vulnerability-class level). The KEDA operator sends a login request to the attacker-controlled endpoint, including the operator's projected ServiceAccount token as the Vault login credential. Because the JWT-shape filter from the CVE-2025-68476 remediation accepts the token (its subject is a Kubernetes ServiceAccount), the credential is transmitted rather than blocked. The attacker captures the token at their endpoint — this is a credential-exfiltration step, not code execution. No specific request paths or parameters are fabricated here; the mechanism is the forwarding of the operator's token to an attacker-controlled address.

4. Post-exploitation impact. With the operator's projected ServiceAccount token in hand, the attacker can authenticate to the Kubernetes API server as the KEDA operator. Since the operator holds cluster-wide permissions, the attacker inherits those privileges, including broad Secret reads and workload or admission-related operations. This enables lateral movement, credential harvesting from Secrets, and potentially modification of workloads or admission controls across the cluster.

Impact Assessment

The CVSS v3.1 base score is 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The network attack vector (AV:N) reflects that the Kubernetes API server is reachable over the network. Low attack complexity (AC:L) indicates no special conditions beyond the documented configuration. Low privileges required (PR:L) corresponds to the namespace-administrator role. No user interaction (UI:N) is needed. Scope is changed (S:C) because a namespace-scoped primitive compromises the cluster-scoped KEDA operator. Confidentiality, Integrity, and Availability are each High (C:H/I:H/A:H).

Business impact is severe: compromise of the KEDA operator's cluster-wide identity can expose Secrets across all namespaces, enable tampering with workloads and admission-related operations, and facilitate broad lateral movement within the Kubernetes environment. Blast radius extends beyond the attacker's originating namespace to any resource the KEDA operator can access. Multi-tenant clusters where namespace administrators are not fully trusted are at the highest risk. EPSS has not yet been scored by FIRST.org, and CISA KEV status is NO; there is no evidence of active exploitation in the wild at the time of writing.

Detection Guidance

Sigma Rule

title: KEDA TriggerAuthentication Vault Address Redirect for Operator Token Theft
id: 7f3a1c2e-9b4d-4e6a-8c1f-2d5e6a7b8c9d
status: experimental
description: Detects creation or modification of KEDA TriggerAuthentication resources that set a hashiCorpVault address, potentially redirecting the operator's ServiceAccount token to an attacker-controlled endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-77524
author: Threat Intelligence
date: 2026/01/01
tags:
    - attack.privilege_escalation
    - attack.t1078.004
    - cve.2026.77524
logsource:
    product: kubernetes
    service: audit
detection:
    selection_verb:
        verb:
            - create
            - update
            - patch
    selection_resource:
        objectRef.resource: 'triggerauthentications'
        objectRef.apiGroup: 'keda.sh'
    selection_vault:
        requestObject.spec.hashiCorpVault.address|contains: 'http'
    condition: selection_verb and selection_resource and selection_vault
falsepositives:
    - Legitimate administrative configuration of Vault authentication in KEDA
level: high

YARA Rule

rule CVE_2026_77524_KEDA_Vault_Redirect
{
    meta:
        description = "Detects KEDA TriggerAuthentication manifests that set hashiCorpVault.address, indicating possible operator token redirection"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77524"
        date = "2026-01-01"
        severity = "high"

    strings:
        $keda_api = "keda.sh"
        $ta_kind = "TriggerAuthentication"
        $vault = "hashiCorpVault"
        $addr = "address:"
        $k8sauth = "kubernetes"
        $so = "ScaledObject"

    condition:
        $keda_api and $ta_kind and $vault and $addr and ($k8sauth or $so)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77524 KEDA Operator ServiceAccount Token Sent to External Vault Endpoint"; flow:to_server,established; content:"POST"; http_method; content:"/v1/auth/"; http_uri; content:"kubernetes"; http_uri; content:"jwt"; http_client_body; pcre:"/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/"; reference:cve,2026-77524; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77524; classtype:attempted-user; sid:202677524; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [any where event.category == "kubernetes" and kubernetes.audit.objectRef.resource == "triggerauthentications" and kubernetes.audit.verb in ("create", "update", "patch")]
  [network where destination.address != null and process.name == "keda" and event.action == "connection_attempted"]

Splunk SPL Query

index=kubernetes sourcetype=kube:apiserver:audit
    objectRef.resource="triggerauthentications"
    (verb="create" OR verb="update" OR verb="patch")
    requestObject.spec.hashiCorpVault.address=*
| stats count min(_time) as first_seen max(_time) as last_seen
        values(requestObject.spec.hashiCorpVault.address) as vault_addresses
        by user.username objectRef.namespace objectRef.name
| where count >= 1
| sort - first_seen

Wazuh OSSEC Rule

<group name="kubernetes,keda,">
  <rule id="100775" level="12">
    <decoded_as>json</decoded_as>
    <field name="objectRef.resource">^triggerauthentications$</field>
    <field name="verb">^(create|update|patch)$</field>
    <field name="requestObject.spec.hashiCorpVault.address">\.</field>
    <description>CVE-2026-77524: KEDA TriggerAuthentication modified with hashiCorpVault address - possible operator ServiceAccount token redirection</description>
    <mitre>
      <id>T1078.004</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict the ability to create or modify TriggerAuthentication and ScaledObject resources to trusted principals only; audit and remove namespace-admin privileges from untrusted tenants. Where feasible, deny or constrain the hashiCorpVault.address field via Kubernetes admission policies (e.g., validating that Vault addresses match an approved allowlist). Monitor Kubernetes audit logs for TriggerAuthentication creations that specify a hashiCorpVault.address, and block egress from the KEDA operator namespace to unapproved endpoints using NetworkPolicy. Rotate the KEDA operator's ServiceAccount token if compromise is suspected and review the operator's RBAC for excess cluster-wide permissions.

2. Patch / upgrade steps. Upgrade KEDA to version 2.21.0, which fixes this vulnerability. After upgrading, verify the operator redeploys and that the JWT handling change is in effect. Because no patch evidence is available from tracked sources (vendor fix not listed, no OSV packages), validate the release against official KEDA release notes before deployment.

3. Long-term hardening. Apply least privilege to the KEDA operator's ServiceAccount, limiting Secret read access and admission-related permissions to only what is required. Enforce strict tenant isolation so that namespace administrators cannot influence operator-level authentication configuration. Implement admission control to validate external authentication endpoints, and adopt a policy of not trusting tenant-supplied configuration that affects operator identity. Continuously monitor for CVE-2026-77524 remediation updates and EPSS scoring changes.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-77524
• KEDA (Kubernetes Event Driven Autoscaling) — https://keda.sh
• CVE-2025-68476 (related JWT-shape filter remediation referenced in the NVD description)
• MITRE ATT&CK T1078.004 — Valid Accounts: Cloud Accounts — https://attack.mitre.org/techniques/T1078/004/
• CWE-269 — Improper Privilege Management — https://cwe.mitre.org/data/definitions/269.html

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-77524 at the time of writing; CISA KEV status is NO, no public PoC or exploit code is available, and no Nuclei template exists.