CVE-2026-53572
Fixed in a distro release EPSS <1%CVSS 5.9
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0.
Products: kedacore keda
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kedacore/keda | no fix |
| Go | github.com/kedacore/keda/v2 | 2.20.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | k8sgpt | 0 |
| Chainguard | keda-2.17 | no fix |
| Chainguard | keda-2.17-admission-webhooks | no fix |
| Chainguard | keda-2.17-metrics-apiserver | no fix |
| Chainguard | keda-2.18 | no fix |
| Chainguard | keda-2.18-admission-webhooks | no fix |
| Chainguard | keda-2.18-metrics-apiserver | no fix |
| Chainguard | keda-2.19 | no fix |
| Chainguard | keda-2.19-admission-webhooks | 0 |
| Chainguard | keda-2.19-metrics-apiserver | 0 |
| Chainguard | keda-fips-2.17 | no fix |
| Chainguard | keda-fips-2.17-admission-webhooks | no fix |
| Chainguard | keda-fips-2.17-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.18 | no fix |
| Chainguard | keda-fips-2.18-admission-webhooks | no fix |
| Chainguard | keda-fips-2.18-metrics-apiserver | no fix |
| Chainguard | keda-fips-2.19 | no fix |
| Chainguard | keda-fips-2.19-admission-webhooks | 0 |
| Chainguard | keda-fips-2.19-metrics-apiserver | 0 |
| Chainguard | keda-http-add-on-interceptor | 0.15.0-r1 |
| Chainguard | keda-http-add-on-interceptor-fips | 0.15.0-r4 |
| Chainguard | keda-http-add-on-operator | 0.15.0-r1 |
| Chainguard | keda-http-add-on-operator-fips | 0.15.0-r4 |
| Chainguard | keda-http-add-on-scaler | 0.15.0-r1 |
| Chainguard | keda-http-add-on-scaler-fips | 0.15.0-r4 |
| Chainguard | kserve-agent | 0 |
| Chainguard | kserve-agent-fips | 0 |
| Chainguard | kserve-localmodel | 0 |
| Chainguard | kserve-localmodelnode-agent | 0 |
| Chainguard | kserve-localmodelnode-agent-fips | 0 |
| Chainguard | kserve-manager | 0 |
| Chainguard | kserve-manager-fips | 0 |
| Chainguard | kserve-router | 0 |
| Chainguard | verticadb-operator | 0 |
| Chainguard | verticadb-operator-fips | 0 |
| Wolfi | k8sgpt | 0 |
| Wolfi | keda-2.19 | no fix |
| Wolfi | keda-2.19-admission-webhooks | 0 |
| Wolfi | keda-2.19-metrics-apiserver | 0 |
| Wolfi | kserve-agent | 0 |
| Wolfi | kserve-localmodel | 0 |
| Wolfi | kserve-manager | 0 |
| Wolfi | kserve-router | 0 |
| Wolfi | verticadb-operator | 0 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |