Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kedacore/keda
main @ 25e37bd
39
Fixes
1
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Denial of Service: 22 prior fixes. Scrutinize any change in this area.
RBAC: most-fixed (2 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Inadequate verification of projected service account token files allowed attackers with resource modification permissions to supply arbitrary local file paths, leading to local arbitrary file disclosure. This is publicly tracked as CVE-2025-68476.
Auth Bypass: Failure to enforce strict namespace restrictions during KEDA secret resolution allowed potential cross-namespace authorization bypasses, exposing sensitive data belonging to other namespaces.
Denial of Service: Systemic resource exhaustion caused by unclosed HTTP/AMQP connections and active scalers leaking file descriptors during error paths or disposal.