Homepage

Improper Privilege Management Affecting keda-fips-2.18-metrics-apiserver package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.64% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KEDAFIPS218METRICSAPISERVER-21158933
  • published17 Oct 2026
  • disclosed14 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 14 Oct 2026

NewCVE-2026-77524  (opens in a new tab)
CWE-269  (opens in a new tab)
CWE-918  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest keda-fips-2.18-metrics-apiserver.

NVD Description

Note: Versions mentioned in the description apply only to the upstream keda-fips-2.18-metrics-apiserver package and not the keda-fips-2.18-metrics-apiserver package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential. The JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, so the attacker can obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations. This vulnerability is fixed in 2.21.0.