GoPackage

github.com/kedacore/keda

3 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v1.5.0 (Jul 7, 2020): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 1 critical, 1 high, 1 medium

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-77524Critical 9.9
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Affected: through 1.5.0; all versions.
No fix released. The latest release, v1.5.0, is still affected.
CVE-2026-53572Medium 5.9
KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
Affected: all versions.
No fix released. The latest release, v1.5.0, is still affected.
CVE-2025-68476High 8.2
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential
Affected: all versions.
No fix released. The latest release, v1.5.0, is still affected.