CVE-2026-53572: KEDA PostgreSQL Scaler SSRF Vulnerability

CVE-2026-53572 Overview

CVE-2026-53572 is a connection string injection vulnerability in KEDA, the Kubernetes-based Event Driven Autoscaling component. The flaw resides in pkg/scalers/postgresql_scaler.go, which builds libpq-style connection strings from tenant-controlled fields including host, port, userName, dbName, sslmode, and password. The helper escapePostgreConnectionParameter() only quotes values containing a literal space, leaving other whitespace and metacharacters unescaped. An attacker with permission to create or modify a TriggerAuthentication or ScaledObject can inject additional key-value tokens parsed by pgx, redirecting connections to an attacker-controlled database. The issue is fixed in KEDA 2.20.0. This vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
Attackers with tenant-level access to KEDA resources can hijack PostgreSQL connections, exfiltrate database credentials, and disable TLS protection by injecting parameters through unescaped whitespace and metacharacters.

Affected Products

KEDA versions prior to 2.20.0
pkg/scalers/postgresql_scaler.go PostgreSQL scaler component
Kubernetes clusters using KEDA TriggerAuthentication or ScaledObject resources referencing PostgreSQL

Discovery Timeline

2026-08-21 - CVE-2026-53572 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-53572

Vulnerability Analysis

KEDA constructs PostgreSQL connection strings by concatenating user-supplied parameters into libpq key-value syntax. The escaping function escapePostgreConnectionParameter() only wraps values in single quotes when the value contains a space character. This narrow filter fails to account for other whitespace and delimiter characters that pgx interprets as token separators.

Characters such as tab, newline, carriage return, form feed, vertical tab, single quote, and backslash pass through unescaped. When pgx parses the resulting string, these characters terminate the current value and introduce attacker-controlled keys such as host or sslmode. The attacker gains control over where the scaler connects and how the connection is secured.

Exploitation requires the attacker to hold rights to create or modify KEDA custom resources in the target namespace. The impact includes redirection of authentication attempts to a rogue server, exposure of the database password sent during handshake, and downgrade of TLS enforcement.

Root Cause

The root cause is incomplete input neutralization in escapePostgreConnectionParameter(). The function assumed that only spaces required quoting, but the libpq/pgx grammar treats a broader set of characters as token boundaries. This mismatch allows tenant-controlled fields to break out of their intended value context and inject arbitrary connection parameters.

Attack Vector

An authenticated Kubernetes user with permission over TriggerAuthentication or ScaledObject resources supplies a crafted value containing a tab or newline followed by an additional parameter. When KEDA loads the trigger and connects to PostgreSQL, pgx parses the injected host=attacker.example.com or sslmode=disable token. The scaler then authenticates against the attacker's server, leaking credentials.

 	"regexp"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"

Source: KEDA commit 703de9d. The patch imports the unicode package to broaden whitespace detection when deciding whether a value must be quoted.

Detection Methods for CVE-2026-53572

Indicators of Compromise

TriggerAuthentication or ScaledObject resources containing tab, newline, carriage return, backslash, or single-quote characters in host, port, userName, dbName, sslmode, or password fields.
KEDA operator logs showing PostgreSQL connections to hosts not present in the intended database allowlist.
Unexpected outbound network flows from the KEDA operator pod to external IP addresses on TCP/5432.

Detection Strategies

Audit all KEDA custom resources for non-printable characters and shell metacharacters in PostgreSQL scaler parameters.
Compare resolved connection targets in KEDA operator logs against a known list of approved PostgreSQL endpoints.
Enforce Kubernetes admission policies (OPA/Gatekeeper, Kyverno) that reject TriggerAuthentication values containing whitespace beyond the space character.

Monitoring Recommendations

Monitor Kubernetes audit logs for create and update events on keda.sh/v1alpha1TriggerAuthentication and ScaledObject resources.
Alert on egress traffic from KEDA namespaces to PostgreSQL ports outside the cluster or approved database subnet.
Track KEDA operator TLS handshake failures and unexpected sslmode=disable negotiations against PostgreSQL backends.

How to Mitigate CVE-2026-53572

Immediate Actions Required

Upgrade KEDA to version 2.20.0 or later in every cluster running the PostgreSQL scaler.
Review existing TriggerAuthentication and ScaledObject resources for suspicious whitespace or metacharacters and remove any unauthorized entries.
Restrict RBAC permissions on KEDA custom resources so only trusted principals can create or modify PostgreSQL trigger definitions.

Patch Information

The fix is included in KEDA release v2.20.0. The patch, tracked in pull request #7787 and referenced in issue #7784, expands the escaping logic in escapePostgreConnectionParameter() to quote values containing any Unicode whitespace character. Full details are available in GitHub Security Advisory GHSA-6w3m-4hhp-775q.

Workarounds

Remove or disable the PostgreSQL scaler until the upgrade to 2.20.0 is complete.
Enforce admission control that rejects KEDA resources whose PostgreSQL parameters contain characters outside a strict allowlist.
Rotate PostgreSQL credentials that may have been referenced by tenant-controlled trigger authentications.

bash

# Upgrade KEDA via Helm to the patched release
helm repo update kedacore
helm upgrade keda kedacore/keda \
  --namespace keda \
  --version 2.20.0

# Verify the deployed version
kubectl get deployment keda-operator -n keda \
  -o jsonpath='{.spec.template.spec.containers[0].image}'