Vulnerability-Lookup

CVE-2025-68476 (GCVE-0-2025-68476)

Vulnerability from cvelistv5 – Published: 2025-12-22 21:35 – Updated: 2025-12-22 21:56

Title

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Summary

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-22 21:55 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/kedacore/keda/security/advisor…	x_refsource_CONFIRM
https://github.com/kedacore/keda/commit/15c5677f6…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
kedacore	keda	Affected: < 2.17.3 Affected: >= 2.18.0, < 2.18.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T21:55:53.031327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T21:56:03.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "keda",
          "vendor": "kedacore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.17.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.18.0, \u003c 2.18.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node\u0027s filesystem (where the KEDA pod resides) by directing the file\u0027s content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-22T21:35:00.480Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr"
        },
        {
          "name": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd"
        }
      ],
      "source": {
        "advisory": "GHSA-c4p6-qg4m-9jmr",
        "discovery": "UNKNOWN"
      },
      "title": "KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68476",
    "datePublished": "2025-12-22T21:35:00.480Z",
    "dateReserved": "2025-12-18T13:52:15.491Z",
    "dateUpdated": "2025-12-22T21:56:03.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68476",
      "date": "2026-09-22",
      "epss": "0.00554",
      "percentile": "0.45119"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-08T01:39:41.000Z",
      "cve": "CVE-2025-68476",
      "id": "msrc_CVE-2025-68476",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-68476.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "keda",
                "vendor": "kedacore",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.17.3"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.18.0, \u003c 2.18.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node\u0027s filesystem (where the KEDA pod resides) by directing the file\u0027s content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3."
          }
        ],
        "id": "CVE-2025-68476",
        "lastModified": "2026-06-17T09:59:07.690",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "HIGH",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-68476",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T21:55:53.031327Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-22T22:16:09.307",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-24T15:00:51+00:00",
      "cve": "CVE-2025-68476",
      "id": "CVE-2025-68476",
      "initial_release_date": "2025-12-22T21:35:00.480000+00:00",
      "product_status:fixed": "44",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "513",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68476.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-68476",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-22T21:55:53.031327Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-22T21:55:57.912Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "keda",
              "vendor": "kedacore",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.17.3"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.18.0, \u003c 2.18.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node\u0027s filesystem (where the KEDA pod resides) by directing the file\u0027s content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "HIGH",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "HIGH",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-22T21:35:00.480Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr"
            },
            {
              "name": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd"
            }
          ],
          "source": {
            "advisory": "GHSA-c4p6-qg4m-9jmr",
            "discovery": "UNKNOWN"
          },
          "title": "KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-68476",
        "datePublished": "2025-12-22T21:35:00.480Z",
        "dateReserved": "2025-12-18T13:52:15.491Z",
        "dateUpdated": "2025-12-22T21:56:03.904Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-68476

Vulnerability from fkie_nvd - Published: 2025-12-22 22:16 - Updated: 2026-06-17 09:59

Severity

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd
	security-advisories@github.com	https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "keda",
          "vendor": "kedacore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.17.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.18.0, \u003c 2.18.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node\u0027s filesystem (where the KEDA pod resides) by directing the file\u0027s content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3."
    }
  ],
  "id": "CVE-2025-68476",
  "lastModified": "2026-06-17T09:59:07.690",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68476",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-22T21:55:53.031327Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-22T22:16:09.307",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-C4P6-QG4M-9JMR

Vulnerability from github – Published: 2025-12-22 20:08 – Updated: 2025-12-23 16:01

Summary

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Details

Impact

An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication.

The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount.

An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request.

The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd.

Patches

The problem has been patched in v2.17.3 and 2.18.3 as well as in main branch.

Workarounds

The only effective workaround is the strict restriction of permissions for creating and modifying TriggerAuthentication resources within the Kubernetes cluster.

Only trusted and authorized users should have create or update permissions on the TriggerAuthentication resource.

This limits an attacker's ability to configure a malicious TriggerAuthentication with an arbitrary path.

Is my project affected?

If it execute s

kubectl get deploy keda-operator -n keda -o jsonpath="{.spec.template.spec.containers[0].image}"

and the version is not 2.17.3, 2.18.3 or >= 2.19.0, that version is affected.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kedacore/keda/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.18.0"
            },
            {
              "fixed": "2.18.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kedacore/keda/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.17.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-22T20:08:24Z",
    "nvd_published_at": "2025-12-22T22:16:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAn Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication.\n\nThe vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount.\n\nAn attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node\u0027s filesystem (where the KEDA pod resides) by directing the file\u0027s content to a server under their control, as part of the Vault authentication request.\n\nThe potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd.\n\n### Patches\nThe problem has been patched in v2.17.3 and 2.18.3 as well as in main branch.\n\n### Workarounds\nThe only effective workaround is the strict restriction of permissions for creating and modifying TriggerAuthentication resources within the Kubernetes cluster.\n\nOnly trusted and authorized users should have create or update permissions on the TriggerAuthentication resource.\n\nThis limits an attacker\u0027s ability to configure a malicious TriggerAuthentication with an arbitrary path.\n\n### Is my project affected?\nIf it execute s\n```bash\nkubectl get deploy keda-operator -n keda -o jsonpath=\"{.spec.template.spec.containers[0].image}\"\n```\nand the version is not 2.17.3, 2.18.3 or \u003e= 2.19.0, that version is affected.",
  "id": "GHSA-c4p6-qg4m-9jmr",
  "modified": "2025-12-23T16:01:17Z",
  "published": "2025-12-22T20:08:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68476"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kedacore/keda"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential"
}

MSRC_CVE-2025-68476

Vulnerability from csaf_microsoft - Published: 2025-12-02 00:00 - Updated: 2026-01-08 01:39

Summary

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Scope

1 vulnerability in this advisory, including CVE-2025-68476.

CVE-2025-68476

Fixed: 1 product Known affected: 1 product Known not affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

RHSA-2026:2106

Vulnerability from csaf_redhat - Published: 2026-02-05 13:38 - Updated: 2026-09-22 12:55

Summary

Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI

Severity

Important

Scope

15 vulnerabilities in this advisory, including CVE-2025-68476.

CVE-2025-68476

A flaw was found in KEDA, a Kubernetes-based Event Driven Autoscaling component. This arbitrary file read vulnerability allows an attacker with permissions to create or modify a TriggerAuthentication resource to read any file from the node's filesystem where the KEDA pod resides. This is due to insufficient path validation when handling Service Account Tokens during HashiCorp Vault authentication. Successful exploitation can lead to the exfiltration of sensitive system information, such as secrets or configuration files.

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fixed: 8 products Known not affected: 200 products

https://access.redhat.com/errata/RHSA-2026:2106

Open the full advisory

RHSA-2026:2368

Vulnerability from csaf_redhat - Published: 2026-02-09 19:25 - Updated: 2026-09-17 07:10

Summary

Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.18.1-2 Update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-68476.

CVE-2025-68476

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fixed: 16 products Known not affected: 1 product

https://access.redhat.com/errata/RHSA-2026:2368

Open the full advisory

RHSA-2026:2695

Vulnerability from csaf_redhat - Published: 2026-02-12 22:43 - Updated: 2026-09-22 12:56

Summary

Red Hat Security Advisory: RHOAI 2.25.2 - Red Hat OpenShift AI

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2025-68476.

CVE-2025-68476

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fixed: 4 products Known not affected: 91 products

https://access.redhat.com/errata/RHSA-2026:2695

Open the full advisory

RHSA-2026:3713

Vulnerability from csaf_redhat - Published: 2026-03-04 07:18 - Updated: 2026-09-22 13:15

Summary

Red Hat Security Advisory: RHOAI 3.3 - Red Hat OpenShift AI

Severity

Critical

Scope

46 vulnerabilities in this advisory, including CVE-2025-68476.

CVE-2025-68476

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Fixed: 16 products Known not affected: 217 products

https://access.redhat.com/errata/RHSA-2026:3713

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-68476 (GCVE-0-2025-68476)

FKIE_CVE-2025-68476

GHSA-C4P6-QG4M-9JMR

Impact

Patches

Workarounds

Is my project affected?

MSRC_CVE-2025-68476

RHSA-2026:2106

RHSA-2026:2368

RHSA-2026:2695

RHSA-2026:3713

Tags

Sightings

Nomenclature

Related by attack behaviour