CVE-2026-53572 kedacore CVE debrief

Who should care

Organizations using KEDA for event-driven autoscaling, especially those with PostgreSQL databases, should be aware of this vulnerability and take steps to patch or mitigate it. This includes reviewing and restricting access to TriggerAuthentication and ScaledObject resources, monitoring database connections for suspicious activity, and prioritizing patching to prevent potential database connection hijacking and credential exposure. Security teams and operators managing KEDA deployments should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. Asset inventory and vulnerability management teams should also be informed to ensure proper prioritization and mitigation of this vulnerability. The vulnerability management process should be updated to include checks for KEDA version 2.20.0 or later. Additionally, the security team should verify that the patch is applied and that the vulnerability is not still exploitable. They should also review the GitHub commit fixing the vulnerability and the release notes for version 2.20.0 to understand the changes made to fix this issue. Finally, they should ensure that all KEDA deployments are updated to version 2.20.0 or later to prevent potential exploitation of this vulnerability. This should be done as soon as possible to minimize the risk of exploitation. The security team should also consider implementing additional security measures, such as monitoring for suspicious activity and implementing compensating controls, to further reduce the risk of exploitation. They should also review the CVE record and official advisory to ensure that all necessary steps are taken to mitigate this vulnerability. The security team should also verify that all KEDA users

Technical summary

KEDA's pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from user-controlled input without proper escaping, allowing attackers to inject host or sslmode parameters. This can lead to database connection hijacking, credential exposure, or disabling of intended TLS protection. The vulnerability is fixed in version 2.20.0. Review and restrict access to TriggerAuthentication and ScaledObject resources. Monitor database connections for suspicious activity.

Defensive priority

Organizations using KEDA should prioritize patching to prevent potential database connection hijacking and credential exposure.

Recommended defensive actions

• Patch KEDA to version 2.20.0 or later
• Review and restrict access to TriggerAuthentication and ScaledObject resources
• Monitor database connections for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates that KEDA, a Kubernetes-based Event Driven Autoscaling component, is vulnerable to connection string injection attacks prior to version 2.20.0. An attacker could inject host or sslmode parameters, redirecting the database connection to an attacker-controlled server, exposing credentials, or disabling intended TLS protection.

Official resources