Evidence used
- No CISA KEV confirmation is currently recorded.
- EPSS is 0.55% for the current model date.
BlackTreeCVE IntelligenceFull vulnerability report · 2025
CVE-2025-68476High confidence
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential
kedacore · keda
Official source article: GitHub GHSA-C4P6-QG4M-9JMR ↗. Check the applicable product and release in the original source.
8.2HighCVSS 4.0
Within 7 days
Patch availableHigh technical severity; prioritise exposed affected systems while verifying vendor guidance.
R
Open reassessment dashboard →Operational reassessment
Published severity in operational context
Published severityHigh→Operational priority:High, unchanged from published severity.unchanged
Compensating controls
- Validate the affected product branch and deploy the verified fixed release.
- Restrict the affected network interface to trusted sources where business-safe.
- Monitor vendor guidance and exploitation sources for a material change.
Verification
- Confirm that the asset runs kedacore keda and falls inside the recorded affected range.
- Verify the installed build against the product-specific fixed version after deployment.
- Validate exposure, authentication requirements and compensating controls in the actual environment.
- Reopen this reassessment when CVSS, KEV, EPSS, exploit evidence or remediation changes.
Open-source package ranges4 source-attributed ranges
These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
| Ecosystem and package | Affected range | First fixed version | Evidence |
|---|---|---|---|
| Gogithub.com/kedacore/keda/v2 | SEMVER: introduced 2.18.0; fixed 2.18.3 | 2.18.3 | OSV record ↗aggregator derived · 10 Sep 2026 |
| Gogithub.com/kedacore/keda/v2 | SEMVER: introduced 0; fixed 2.17.3 | 2.17.3 | OSV record ↗aggregator derived · 10 Sep 2026 |
| gogithub.com/kedacore/keda/v2 | >= 2.18.0, < 2.18.3 | 2.18.3 | GitHub advisory ↗upstream repository advisory · 23 Dec 2025 |
| gogithub.com/kedacore/keda/v2 | < 2.17.3 | 2.17.3 | GitHub advisory ↗upstream repository advisory · 23 Dec 2025 |
Direct vendor intelligence
1 currentAuthoritative vendor CSAF and VEX advisories
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
CVE-2025-68476 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitygithub.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication
The vendor explicitly identifies these products as affected by this CVE.
- dvo/deployment-validation-rhel8-operator as a component of Deployment Validation Operator
- openshift-serverless-1/kn-ekb-dispatcher-rhel9 as a component of OpenShift Serverless
- openshift-serverless-1/kn-ekb-receiver-rhel9 as a component of OpenShift Serverless
- Summary
- A flaw was found in KEDA, a Kubernetes-based Event Driven Autoscaling component. This arbitrary file read vulnerability allows an attacker with permissions to create or modify a TriggerAuthentication resource to read any file from the node's filesystem where the KEDA pod resides. This is due to insufficient path validation when handling Service Account Tokens during HashiCorp Vault authentication. Successful exploitation can lead to the exfiltration of sensitive system information, such as secrets or configuration files.
- Remediation
- Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
High technical severity; prioritise exposed affected systems while verifying vendor guidance.
Patch available01
What, why and how
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.
What
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.
Why
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
How
An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
What
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.
Why
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
How
An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
02
Exploit reality and attack path
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
Observed exploitation No confirmed evidence
?
Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
Public PoC / exploit material None recorded
?
Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
- Likely attack path
- a network path → Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') → cause the confidentiality, integrity or availability impact described by the vendor
- Attack surface
- Network
- Privileges required
- High: elevated access is required
- User interaction
- None
- Attack complexity
- Low: no specialised conditions are recorded
- Security boundary
- Not a CVSS 4.0 base metric
- Weakness
?
CWE means Common Weakness Enumeration: a standard category for the underlying weakness. - CWE-22 ↗
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CVSS vector
?
CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity. CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:NCommon Vulnerability Scoring System 4.0: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.ATNoneAttack requirements: No additional deployment or execution condition is required.PRHighPrivileges required: The attacker needs elevated or administrative privileges.UINoneUser interaction: No action by another user is required.VCHighVulnerable-system confidentiality: A successful attack can cause a major loss.VINoneVulnerable-system integrity: No direct loss is represented by this metric.VANoneVulnerable-system availability: No direct loss is represented by this metric.SCHighSubsequent-system confidentiality: A successful attack can cause a major loss.SINoneSubsequent-system integrity: No direct loss is represented by this metric.SANoneSubsequent-system availability: No direct loss is represented by this metric.- Post-exploitation / living off the land
- Stolen credentials, tokens and legitimate administration functions may provide continued access without deploying a large custom toolset.
03
Patch and workaround
Operational remediation based on structured source evidence.
- Status
?
Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change. - Patch available
- Affected
- Fixed
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:2f25021a561f15be90c5bca9bfafc43f9c8e142c75d1fc9ee317ab0943b7054e_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:57e58fa24aed52d153adb8e9eb2b97c7cc7144723bea8b92fb0f518c864e5003_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:7f9e53e5a6aa6670ab29f6e0001326f75393a17efb515bf174d4c9515c152758_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:cf3f3bf999c1065bc3d0b7580bd922daec789f98da5812069cea1333520f876b_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:53a8ffbe94da6658c66bcf8d85e2e113f7bd85cff3f42a258e5ce6662ec2cb1d_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:6a90e03aefc5449d621907b8144acf3637b6a9705e50d6dda58a3ad3f112ac1c_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:ad045c0a324d63ac1fd3277233a96606f91dc32268ad94e6676d3081fa8ea8d1_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:c25f659d9e7e50206a86e3617efbc7f2f4b750ced52fcc18a38bf03b4d89660a_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:1a99333dd543488726051028e58eea4eaf5585a5993264faffbb7ccc151fc83e_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:5aedc4d3b27cba4acf7599e88cf0716cf47f6374f150237508d87f29094cf70d_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:7c238fccaf2517e70f439cfbb860a7fbeaa27e6a295bc6a85b321179d65b2b23_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:b9ec010e078cab2c432f2b240b8b8940a5fb6dbc347138215b80f7131f1435d0_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:7e8fb81460623c77a7c45c5e4b48e09d1da9e3441f8eb01be33f4ac5318b82a1_s390x as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:a02f9d2ff968196d532f9ca1858ec1ea3ca81726f111df22cf28bb6d7818f2ca_amd64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:d0a2e099d9b87ceb1aa7b716a325c446172d1f4b365352e3c275dbfb604cd7b2_ppc64le as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:e4a1bf51de7f95506dc58db125188c07d82b64aad83052c81c2262f8613af98d_arm64 as a component of Custom Metric Autoscaler operator for Red Hat Openshift 2.18
- registry.redhat.io/rhoai/odh-kserve-controller-rhel9@sha256:5b2d40d8d71e583e1bb3f374b724b58ee78a04b8c15e3fc13a249adc3b4c37c0_amd64 as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-kserve-controller-rhel9@sha256:8a3021116d34e958681022873a7a249f9331031df1659181a593c9abc48ca697_ppc64le as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-kserve-controller-rhel9@sha256:8cfd70b3f0864c54c1bcc0ae9f11337c4570aa2c6ced8140810a997b7a842c93_arm64 as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-kserve-controller-rhel9@sha256:f2c8c8a8198292184c29dc3de0b0d341fca30d42191e5e86caa43eaae46eff7c_s390x as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:0ea603487b204f43ebddb1514500cdeaa02a0b763a627e4e10979deec60b7d28_amd64 as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:1c985e860d986a8f7be4fe2afc7176d9a905f187252cdb61206c81cf8389aa45_amd64 as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:29ff94de29714044377d060db9ad47f151afec858c8fc127c94ff04adbb984b7_s390x as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:2b6c00ee23df974d22c185b592ef4d7babbb76bcadc129a04c869f9983630103_ppc64le as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:434c592a3457d383532303e4ca608ec7a99a3ae517a00bc3af1d2d80028609fe_s390x as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:981a2ea3d88b08e312e521c87dca79497991d7cf66304a279e9ca0a50fec5774_ppc64le as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:d4687faf278546087f07a091d654f5a3723985b28ace8632249a8dd6b81a644f_arm64 as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-model-controller-rhel9@sha256:e7c4da685e08c79d5b49e9f12ff5efa7cc7d9e26a03c91ab19f86c99e9f4ac23_arm64 as a component of Red Hat OpenShift AI 2.25
- registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:1f2995ee9de8b0dd7e45fc26dcef5f5a7a2e38b2e564ab3e6460c4af76e22e82_arm64 as a component of Red Hat OpenShift AI 3.3
- registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:599c13b4ecdaf8cfe00bef9270d5ef4286c4f5a238bacf801f901973b152c694_ppc64le as a component of Red Hat OpenShift AI 3.3
- and 14 more
- Action
- Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
- Workaround
- No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04
Evidence and provenance
Published 22 Dec 2025 · Last source change 22 Dec 2025, 21:56 UTC · CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE recordCVE.org · 5.2
CVSS sourceCNA
EPSS source FIRST · tracked since 2026-08-14
?
The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.European sourceENISA EUVD · EUVD-2025-204753
Product sourceVendor CSAF · Red Hat Product Security
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceCNA
NVD statusNVD not scheduled
Core structured fields are present and their contributing authorities are shown above.
Material change intelligence
View recent updates ↗What changed after publication
- Affected versionsThe structured affected or fixed version information changed.Red Hat Product Security ↗
- Before
- keda: < 2.17.3, >= 2.18.0, < 2.18.3 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
- After
- keda: < 2.17.3, >= 2.18.0, < 2.18.3 · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
- Affected versionsThe structured affected or fixed version information changed.Red Hat Product Security ↗
- Before
- < 2.17.3; >= 2.18.0, < 2.18.3 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
- After
- < 2.17.3; >= 2.18.0, < 2.18.3 · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
- Remediation statusRemediation status changed from Awaiting fix to Patch available.Red Hat Product Security ↗
- Before
- Awaiting fix
- After
- Patch available
- Affected versionsThe structured affected or fixed version information changed.CNA ↗
- Before
- keda: < 2.17.3, >= 2.18.0, < 2.18.3 · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
- After
- keda: < 2.17.3, >= 2.18.0, < 2.18.3 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
- Vendor guidanceAuthoritative vendor guidance changed: removed remediation: access.redhat.com/CVE-2025-68476.CNA ↗
- Before
- remediation: access.redhat.com/CVE-2025-68476
- After
- no authoritative guidance recorded
- Affected versionsThe structured affected or fixed version information changed.CNA ↗
- Before
- < 2.17.3; >= 2.18.0, < 2.18.3 · Fixed: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
- After
- keda: < 2.17.3, >= 2.18.0, < 2.18.3 · Fixed: No fixed version is explicitly recorded in the structured CVE data.
- Remediation statusRemediation status changed from Patch available to Awaiting fix.CNA ↗
- Before
- Patch available
- After
- Awaiting fix
CVE published
Fixed release recorded from official guidance
Technical terms and abbreviations used in this report
- CVE
- Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
- CVSS
- Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
- EPSS
- Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
- CWE
- Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
- CNA
- CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
- CISA ADP
- Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
- NVD
- National Vulnerability Database: NIST's enrichment service for CVE records.
- CERT / CSIRT
- A computer security incident response team that publishes warnings or coordinates incident response.
- PoC
- Proof of concept: public material that demonstrates or helps reproduce exploitation.
- CSAF
- Common Security Advisory Framework: a machine-readable format for security advisories.
- LoTL
- Living off the land: abuse of legitimate tools or system functions during an attack.