Listen to this Post
The vulnerability stems from an incomplete security patch for CVE-2025-68476 within the KEDA operator’s HashiCorp Vault authentication mechanism. A namespace administrator who possesses permissions to create TriggerAuthentication and ScaledObject resources within their designated tenant namespace can specify an arbitrary, unvalidated destination address for HashiCorp Vault. By configuring Kubernetes authentication without explicit credentials, KEDA automatically falls back to using its own operator-level ServiceAccount token by default.
When the operator reconciles the malicious ScaledObject, it attempts to authenticate against the tenant-controlled endpoint, leaking its high-privileged ServiceAccount token directly to the attacker. Because the operator token holds extensive cluster-wide privileges—such as reading secrets across all namespaces, managing jobs, and modifying workloads—this design flaw enables a direct privilege escalation from a confined namespace administrator to a full cluster administrator. The preceding content filter mitigation was insufficient because it only verified that the transmitted file resembled a valid JSON Web Token with a standard service account subject, a condition which the operator’s own projected token naturally satisfies without restricting its intended audience or usage destination.
DailyCVE Form:
Platform: KEDA Kubernetes Operator
Version: v2.20.0 and earlier
Vulnerability : Privilege Escalation
Severity: Critical
date: 2026-10-13
Prediction: 2025-10-14
What Undercode Say:
Analytics
The vulnerability allows namespace-level administrators to target the KEDA operator’s reconciliation loop, tricking it into dispatching its cluster-scoped ServiceAccount token to an external listener. Because the operator runs with broad cluster permissions ([""]/[""]), the leaked token grants immediate read access to all cluster secrets and allows arbitrary job creation across namespaces, subverting multi-tenant isolation boundaries.
Bash Commands and Codes
kubectl create namespace tenant-a kubectl -n tenant-a create serviceaccount tenant kubectl -n tenant-a create rolebinding tenant-edit --clusterrole=edit --serviceaccount=tenant-a:tenant kubectl -n tenant-a create role tenant-keda --verb=create,get --resource=triggerauthentications.keda.sh,scaledobjects.keda.sh kubectl -n tenant-a create rolebinding tenant-keda --role=tenant-keda --serviceaccount=tenant-a:tenant
Exploit: (Educational Purposes!)
An attacker deploys a malicious listener service inside their namespace simulating a HashiCorp Vault server, then configures a `TriggerAuthentication` object pointing to it with Kubernetes authentication enabled. When KEDA reconciles the associated ScaledObject, it transmits its own service account token as part of the login payload, which the listener captures to gain cluster administrator control.
Protection: from this CVE
Upgrade KEDA to version 2.21.0 or later, which introduces strict audience validation and enforcement mechanisms for service account tokens used in authentication flows. Ensure proper configuration of operator token modes to prevent unauthorized forwarding paths.
Impact
Complete compromise of the Kubernetes cluster, enabling unauthorized reading of all namespace secrets, modification of cluster admission webhooks, execution of arbitrary workloads across privileged namespaces, and full control-plane takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
