Vulnerability Overview
- CVE Identifier:
CVE-2025-68476- Severity Rating:
- 8.2 / 10.0 - HIGH
- Detection Date:
- 23 Dec 2025
- Vulnerability Type:
- Vulnerability
Description
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.
Potential Impact
This vulnerability poses a high risk to affected systems. Organizations using the affected software should prioritize patching and implement appropriate security measures immediately.
- Unauthorized Access: Potential unauthorized access to sensitive systems or data
- Remote Code Execution: Attackers may execute arbitrary code remotely
- Service Disruption: Risk of service disruption or denial of service attacks
- Data Breach: Possibility of data breach or information disclosure
Recommended Actions
- Immediate Assessment: Identify if your systems are running affected versions of the software
- Apply Patches: Install security updates and patches as soon as they become available
- Implement Workarounds: Apply temporary mitigations if patches are not yet available
- Monitor Systems: Increase monitoring for signs of exploitation attempts
- Update Security Policies: Review and update security policies based on this vulnerability
- Inform Stakeholders: Communicate the risk to relevant stakeholders and teams
Stay Informed: Subscribe to our security alerts to receive timely updates on critical vulnerabilities and security advisories.
Disclaimer: This information is provided for security awareness purposes. Always verify with official sources and consult with security professionals before taking action. The severity scores and information are based on publicly available data at the time of publication.