{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/kedacore/keda","cve_ids":["CVE-2026-77524"],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-637c-6jxx-4rwm","id":"tcs_01M5JJ44MGP35GQE9QYH606XV2","modified_at":"2026-10-19T21:31:49.973645562Z","published_at":"2026-10-19T21:08:35Z","references":["https://osv.dev/vulnerability/GO-2026-6776","https://github.com/kedacore/keda/security/advisories/GHSA-637c-6jxx-4rwm","https://nvd.nist.gov/vuln/detail/CVE-2026-77524","https://github.com/kedacore/keda/commit/1e21cc798dedd079e696cdb45388eddc5e18365d","https://github.com/kedacore/keda/releases/tag/v2.21.0"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GO-2026-6776","url":"https://osv.dev/vulnerability/GO-2026-6776"},{"source":"nvd","source_id":"CVE-2026-77524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77524"}],"summary":"KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda"}