{
  "threat_severity" : "Important",
  "public_date" : "2025-12-22T21:35:00Z",
  "bugzilla" : {
    "description" : "github.com/kedacore/keda: KEDA: Arbitrary file read vulnerability in Vault authentication",
    "id" : "2424509",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2424509"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-22",
  "details" : [ "KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount. An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request. The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd. This issue has been patched in versions 2.17.3 and 2.18.3.", "A flaw was found in KEDA, a Kubernetes-based Event Driven Autoscaling component. This arbitrary file read vulnerability allows an attacker with permissions to create or modify a TriggerAuthentication resource to read any file from the node's filesystem where the KEDA pod resides. This is due to insufficient path validation when handling Service Account Tokens during HashiCorp Vault authentication. Successful exploitation can lead to the exfiltration of sensitive system information, such as secrets or configuration files." ],
  "statement" : "This vulnerability is rated Important because an attacker with permissions to create or modify a KEDA TriggerAuthentication resource can perform arbitrary file reads from the node's filesystem. This impacts Red Hat OpenShift products that utilize KEDA with HashiCorp Vault authentication.",
  "affected_release" : [ {
    "product_name" : "Custom Metric Autoscaler operator for Red Hat Openshift 2.18",
    "release_date" : "2026-02-09T00:00:00Z",
    "advisory" : "RHSA-2026:2368",
    "cpe" : "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.18::el9",
    "package" : "custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9:1770072436"
  }, {
    "product_name" : "Custom Metric Autoscaler operator for Red Hat Openshift 2.18",
    "release_date" : "2026-02-09T00:00:00Z",
    "advisory" : "RHSA-2026:2368",
    "cpe" : "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.18::el9",
    "package" : "custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9:1770071646"
  }, {
    "product_name" : "Custom Metric Autoscaler operator for Red Hat Openshift 2.18",
    "release_date" : "2026-02-09T00:00:00Z",
    "advisory" : "RHSA-2026:2368",
    "cpe" : "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.18::el9",
    "package" : "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9:1770071697"
  }, {
    "product_name" : "Custom Metric Autoscaler operator for Red Hat Openshift 2.18",
    "release_date" : "2026-02-09T00:00:00Z",
    "advisory" : "RHSA-2026:2368",
    "cpe" : "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.18::el9",
    "package" : "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator:1770072020"
  }, {
    "product_name" : "Red Hat OpenShift AI 2.25",
    "release_date" : "2026-02-05T00:00:00Z",
    "advisory" : "RHSA-2026:2106",
    "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9",
    "package" : "rhoai/odh-kserve-controller-rhel9:1770055872"
  }, {
    "product_name" : "Red Hat OpenShift AI 2.25",
    "release_date" : "2026-02-05T00:00:00Z",
    "advisory" : "RHSA-2026:2106",
    "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9",
    "package" : "rhoai/odh-model-controller-rhel9:1770056184"
  }, {
    "product_name" : "Red Hat OpenShift AI 2.25",
    "release_date" : "2026-02-12T00:00:00Z",
    "advisory" : "RHSA-2026:2695",
    "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9",
    "package" : "rhoai/odh-model-controller-rhel9:1770624309"
  }, {
    "product_name" : "Red Hat OpenShift AI 3.3",
    "release_date" : "2026-03-04T00:00:00Z",
    "advisory" : "RHSA-2026:3713",
    "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9",
    "package" : "rhoai/odh-kserve-agent-rhel9:1770754605"
  }, {
    "product_name" : "Red Hat OpenShift AI 3.3",
    "release_date" : "2026-03-04T00:00:00Z",
    "advisory" : "RHSA-2026:3713",
    "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9",
    "package" : "rhoai/odh-kserve-controller-rhel9:1770754646"
  }, {
    "product_name" : "Red Hat OpenShift AI 3.3",
    "release_date" : "2026-03-04T00:00:00Z",
    "advisory" : "RHSA-2026:3713",
    "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9",
    "package" : "rhoai/odh-kserve-router-rhel9:1770754585"
  }, {
    "product_name" : "Red Hat OpenShift AI 3.3",
    "release_date" : "2026-03-04T00:00:00Z",
    "advisory" : "RHSA-2026:3713",
    "cpe" : "cpe:/a:redhat:openshift_ai:3.3::el9",
    "package" : "rhoai/odh-model-controller-rhel9:1771378291"
  } ],
  "package_state" : [ {
    "product_name" : "Deployment Validation Operator",
    "fix_state" : "Affected",
    "package_name" : "dvo/deployment-validation-rhel8-operator",
    "cpe" : "cpe:/a:redhat:deployment_validator_operator"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-1/kn-ekb-receiver-rhel9",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "rhoai/odh-model-registry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Not affected",
    "package_name" : "odf4/mcg-cli-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Not affected",
    "package_name" : "odf4/mcg-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Affected",
    "package_name" : "odf4/odf-cli-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-68476\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68476\nhttps://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd\nhttps://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr" ],
  "name" : "CVE-2025-68476",
  "csaw" : false
}