Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/kedacore/keda/v2

3 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v2.21.0 (Sep 23, 2026): no advisory affects it
Newest unaffected release
v2.21.0 (Sep 23, 2026), the latest release
Advisories
3 · 1 critical, 1 high, 1 medium
Releases
44 since v2.1.0 (Jan 27, 2021)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-77524
    Affects v2.1.0 to v2.20.2 (v2.21.0 is outside it)
  • CVE-2026-53572
    Affects v2.1.0 to v2.19.0 (v2.20.0 is outside it)
  • CVE-2025-68476
    Affects v2.1.0 to v2.17.2 (v2.17.3 is outside it); v2.18.0 to v2.18.2 (v2.18.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-77524Critical 9.9

    KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

    Affected: fixed in 2.21.0.

    Fixed in v2.21.0 (released Sep 23, 2026, 21 days before disclosure).

    The latest release, v2.21.0, is not affected.

  • CVE-2026-53572Medium 5.9

    KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

    Affected: fixed in 2.20.0.

    Fixed in v2.20.0 (released Jun 1, 2026, 81 days before disclosure).

    The latest release, v2.21.0, is not affected.

  • KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

    Affected: from 2.18.0, fixed in 2.18.3; fixed in 2.17.3; fixed in 2.17.3; from 2.18.0, fixed in 2.18.3.

    Fixed in v2.17.3 (released Dec 22, 2025, the day of disclosure) and v2.18.3 (released Dec 22, 2025, the day of disclosure).

    The latest release, v2.21.0, is not affected.