BREAKING CHANGES: Before upgrading from KEDA 2.20

Service account token audience enforcement (CVE-2026-77524)

KEDA 2.21 fixes the critical CVE-2026-77524 / GHSA-637c-6jxx-4rwm. You are affected if you use:

• Vault Kubernetes authentication, including configurations using the operator token, an existing projected token, or credential.serviceAccountName.
• Any TriggerAuthentication or ClusterTriggerAuthentication using boundServiceAccountToken, including integrations with Metrics API, Prometheus, Loki, Datadog Cluster Agent, and other token-authenticated receivers.

You are not affected if you use ordinary Vault token authentication, API keys, OAuth credentials, or another authentication method that does not use a bound service account token. Before upgrading, review carefully the upgrade guide

Temporal Rules-Based Versioning settings

The Temporal scaler no longer accepts the deprecated buildId, selectAllActive, and selectUnversioned settings. Existing ScaledObjects and ScaledJobs containing them will fail scaler metadata parsing. Remove the settings for unversioned workers, or migrate versioned workers to workerDeploymentName and workerDeploymentBuildId. See Temporal Rules-Based Versioning settings.

Azure Pipelines in-flight jobs

KEDA 2.21 adds scaleOnInFlight, defaulting to true. Queue length now includes unfinished jobs already assigned to an agent. Set scaleOnInFlight: false to retain the unassigned-only behavior from KEDA 2.20; for ScaledJobs, combine this with the accurate scaling strategy. See Azure Pipelines in-flight jobs.

Chart: v2.21.0 | App: v2.21.0

Upstream release: https://github.com/kedacore/keda/releases/tag/v2.21.0

KEDA 2.21 contains breaking changes. Before upgrading from 2.20, review the 2.20 to 2.21 migration guide, especially the receiver configuration required by service account token audience enforcement.

TL;DR

helm repo add kedacore https://kedacore.github.io/charts
helm repo update
helm install keda kedacore/keda --version 2.21.0 -n keda --create-namespace

What's Changed

Features

• Controller sharding by label selectors in #864
• Optional pod user namespaces through hostUsers in #880
• Component-specific environment variables in #885
• Configurable operator gRPC metrics-service port in #881
• Shared Azure service-principal authentication fields in the TriggerAuthentication CRDs in #888
• Additional admission-webhook arguments in #902
• Configurable Kubernetes API timeout in #901
• APIService registration control in #909

Security and upgrade changes

• BREAKING CHANGE: Service account token audience enforcement and Vault projection controls in #911
• Kubernetes 1.34 through 1.36 compatibility, published 2.21 CRDs, and the 2.21.0 chart package in #912

Full Changelog: v2.20.2...v2.21.0