Kubernetes Autoscaler Vulnerability in KEDA Affected by Value Injection

CVE-2026-53572

What is CVE-2026-53572?

The KEDA component, which facilitates event-driven autoscaling in Kubernetes, contains a vulnerability that allows for value injection through improperly constructed libpq-style connection strings. When configured with tenant-controlled parameters such as host, port, userName, dbName, sslmode, and password, certain characters are not appropriately escaped. This oversight enables attackers to manipulate connection strings, leading to possible redirection of database connections to malicious servers, exposure of sensitive credentials, or disabling of TLS protections. This vulnerability is addressed in version 2.20.0, and users are encouraged to update to this version to ensure enhanced security.

References