kedacore keda up to 2.17.2/2.18.2 Kubernetes-based Event Driven Autoscaling path traversal

Summaryinfo

A vulnerability labeled as critical has been found in kedacore keda up to 2.17.2/2.18.2. This vulnerability affects unknown code of the component Kubernetes-based Event Driven Autoscaling. Such manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2025-68476. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in kedacore keda up to 2.17.2/2.18.2 and classified as problematic. Affected by this issue is an unknown part of the component Kubernetes-based Event Driven Autoscaling. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-68476 since 12/18/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 2.17.3 or 2.18.3 eliminates this vulnerability. Applying the patch 15c5677f65f809b9b6b59a52f4cf793db0a510fd is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• kedacore

Name

• keda

Version

• 2.17.0
• 2.17.1
• 2.17.2
• 2.18.0
• 2.18.1
• 2.18.2

License

• open-source

Website

• Product: https://github.com/kedacore/keda/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion