CVE-2026-53572

Name of the Vulnerable Software and Affected Versions KEDA (affected versions not specified)

Description An issue exists in the way PostgreSQL connection strings are constructed in pkg/scalers/postgresql scaler.go. The escapePostgreConnectionParameter() function only escapes values containing literal spaces, failing to account for other whitespace characters such as tabs, newlines, carriage returns, and form feeds, as well as backslashes. This allows a tenant to inject additional connection parameters by providing specially crafted values in fields like host, port, userName, dbName, or sslmode. An attacker could use this to force sslmode=disable to downgrade connections to plaintext, redirect connections to an attacker-controlled host to steal credentials, or append arbitrary runtime parameters.

Recommendations As a temporary workaround, restrict the ability of tenants to modify the host, port, userName, dbName, and sslmode fields in TriggerAuthentication or ScaledObject configurations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.