Vulnerability in k8sgpt project

[ankitdn]

While working on k8sgpt project, I found a vulnerability in github.com/kedacore/keda/v2.
The scan reported an Arbitrary File Read vulnerability affecting KEDA’s TriggerAuthentication configuration when used with HashiCorp Vault. Due to insufficient path validation when loading the Service Account Token, an attacker with permission to create or modify TriggerAuthentication resources could potentially read arbitrary files from the node filesystem.

CVE Link
CVE Report

[three-foxes-in-a-trenchcoat]

Thank you for reporting this. To properly assess and address this vulnerability, we need more information:

1. Which version of k8sgpt is affected?
2. What is the current KEDA dependency version in k8sgpt's go.mod?
3. Is k8sgpt directly using the vulnerable KEDA code paths, or is this a transitive dependency?
4. Has KEDA released a patched version that addresses this CVE?

Please provide these details so we can determine if this requires an immediate dependency update or if k8sgpt's usage pattern is unaffected by this specific vulnerability.

[yashrajshuklaaa]

/assign
i'd love to work on this issue pls assign me this one @AlexsJones

[harsh-labz]

/assign @AlexsJones
I’ve handled a similar dependency‑related vulnerability before, where a transitive package exposed a file‑read path. I’d like to take this issue.