{"id":"EUVD-2026-64131","enisaUuid":"ba621da5-5440-34f6-80e5-05b6bb792be1","description":"KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0.","datePublished":"Aug 21, 2026, 8:11:56 PM","dateUpdated":"Aug 25, 2026, 5:13:43 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q\nhttps://github.com/kedacore/keda/issues/7784\nhttps://github.com/kedacore/keda/pull/7787\nhttps://github.com/kedacore/keda/commit/703de9dec86cb25b6ecfa4948880a90487344d3f\nhttps://github.com/kedacore/keda/releases/tag/v2.20.0\n","aliases":"CVE-2026-53572\nGHSA-6w3m-4hhp-775q\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"9cc7582f-bd80-3bad-a922-50924302d573","product":{"name":"keda","vendor":{"name":"kedacore"}},"product_version":"\u003c 2.20.0"}],"enisaIdVendor":[{"id":"e7715ef5-9bee-39c9-8f78-0a2b54aecf9a","vendor":{"name":"kedacore"}}],"enisaIdVulnerability":[{"id":"1f1ca91d-5cac-3d65-b24a-6adcc098d482","vulnerability":{"id":"CVE-2026-53572","description":"KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0.","datePublished":"Aug 21, 2026, 8:11:56 PM","dateUpdated":"Aug 25, 2026, 5:13:43 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q\nhttps://github.com/kedacore/keda/issues/7784\nhttps://github.com/kedacore/keda/pull/7787\nhttps://github.com/kedacore/keda/commit/703de9dec86cb25b6ecfa4948880a90487344d3f\nhttps://github.com/kedacore/keda/releases/tag/v2.20.0\n","enisa_id":"EUVD-2026-64131\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 28, 2026, 7:16:16 AM","vulnerabilityProduct":[{"id":"a55ef6e8-23b8-3b5e-b201-b37c0f1a7afb","product":{"name":"keda","vendor":{"name":"kedacore"}},"product_version":"\u003c 2.20.0"}],"vulnerabilityVendor":[{"id":"4859765e-0aad-3ebe-9f12-0cb22018a91b","vendor":{"name":"kedacore"}}]}},{"id":"a71d1f2f-82fa-3298-a809-732207467686","vulnerability":{"id":"GHSA-6w3m-4hhp-775q","description":"KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping","datePublished":"Jul 7, 2026, 11:44:13 PM","dateUpdated":"Jul 7, 2026, 11:44:13 PM","baseScore":0.0,"references":"https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q\nhttps://github.com/kedacore/keda\n","enisa_id":"EUVD-2026-64131\n","aliases":"GHSA-6w3m-4hhp-775q\nCVE-2026-53572\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"2e770ff4-7d23-3afe-a7ef-da185657444f","advisory":{"id":"msrc_CVE-2026-53572","description":"KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping","datePublished":"Aug 23, 2026, 1:03:01 AM","dateUpdated":"Oct 18, 2026, 1:47:30 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53572.json\n","aliases":"CVE-2026-53572\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"5ceb0b9a-4e0b-3009-a0d2-802ec5d5cf21","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"6ace2e1e-8329-3ebf-85c2-76a4097eaa23","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"872d2f62-5c63-3b42-aa92-86f0a2c695b2","product":{"name":"azl3 keda 0:2.14.1-19.azl3","vendor":{"name":"Microsoft"}}},{"id":"f8f9491d-92fd-3b3d-96ec-45a0f95f910e","product":{"name":"keda","vendor":{"name":"kedacore"}}}]}}]}