CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
Attackers can inject parameters into PostgreSQL connection strings to redirect database connections, exposing credentials or bypassing TLS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53572?
CVE-2026-53572 is a medium-severity vulnerability in kedacore keda, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0.
Which versions are affected by CVE-2026-53572?
4 open source packages ship an affected version, including github.com/kedacore/keda/v2 and github.com/kedacore/keda.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kedacore/keda/v2 Go | All versions | 2.20.0 |
github.com/kedacore/keda/v2 Go | All versions | 2.20.0 |
github.com/kedacore/keda/v2 Go | All versions | 2.20.0 |
github.com/kedacore/keda Go | All versions | None |
How do I fix CVE-2026-53572?
Upgrade github.com/kedacore/keda/v2 to 2.20.0 or later.
Is CVE-2026-53572 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53572 exists.
Sources
Also known as AZL-96989, ECHO-4ad8-fcaa-9133, GHSA-6w3m-4hhp-775q, GO-2026-5940, MINI-4h33-945m-h8c5, MINI-6wg2-f427-7h3m and 6 more.