{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.5.0"}],"component":"github.com/kedacore/keda","cve_ids":["CVE-2026-77524"],"ecosystem":"Go","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-637c-6jxx-4rwm","id":"tcs_01M5JJ5AWV8JRTB4YJ0Q5QB1JW","modified_at":"2026-10-19T21:40:44.489356801Z","published_at":"2026-10-15T20:19:42Z","references":["https://osv.dev/vulnerability/GHSA-637c-6jxx-4rwm","https://github.com/kedacore/keda/security/advisories/GHSA-637c-6jxx-4rwm","https://nvd.nist.gov/vuln/detail/CVE-2026-77524","https://github.com/kedacore/keda/commit/1e21cc798dedd079e696cdb45388eddc5e18365d","https://github.com/kedacore/keda","https://github.com/kedacore/keda/releases/tag/v2.21.0"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-637c-6jxx-4rwm","url":"https://osv.dev/vulnerability/GHSA-637c-6jxx-4rwm"}],"summary":"KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication"}