Description

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter() only quotes values containing a literal space. Tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can therefore create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection. This issue is fixed in version 2.20.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-21T21:16:59.957Z",
  "pubdate": "2026-08-21T21:16:59.957Z",
  "executiveSummary": "An improper input sanitization vulnerability exists within the PostgreSQL scaler component of KEDA prior to version 2.20.0, specifically in pkg/scalers/postgresql_scaler.go.\nThe flaw stems from insufficient escaping mechanisms in the escapePostgreConnectionParameter() function, which only quotes values containing a literal space, failing to properly sanitize control characters such as tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes.\nAn authenticated attacker with permissions to create or modify a TriggerAuthentication or ScaledObject resource can exploit this vulnerability by injecting arbitrary parameters into libpq-style connection strings.\nSuccessful exploitation allows attackers to manipulate connection parameters like host or sslmode, effectively redirecting database connections to attacker-controlled servers, capturing sensitive credentials, or downgrading and disabling intended Transport Layer Security (TLS) protections.\nThe risk implication is severe as it compromises database integrity, confidentiality, and potentially cluster-level credentials utilized by the autoscaling mechanism.\nExploitation requires the attacker to have sufficient cluster privileges to provision or manipulate KEDA scaling definitions (TriggerAuthentication or ScaledObject), granting them the capability to supply malformed tenant-controlled parameters that the underlying pgx library parses into additional key-value tokens.",
  "technicalDetails": "The vulnerability resides in the PostgreSQL scaler implementation located at pkg/scalers/postgresql_scaler.go within KEDA prior to version 2.20.0.\nThe root cause of the vulnerability is flawed parameter serialization logic within the escapePostgreConnectionParameter() function. When constructing libpq-style connection strings from tenant-controlled input parameters—namely host, port, userName, dbName, sslmode, and password—the function exclusively checks for and quotes values containing a literal space.\nIt fails to sanitize or appropriately quote other whitespace and control characters, including tabs, newlines, carriage returns, form feeds, vertical tabs, single/double quotes, and backslashes.\nWhen the underlying pgx database driver parses the resulting malformed libpq connection string, these unsanitized control characters are interpreted as token delimiters. Consequently, an attacker can inject arbitrary key-value tokens into the connection string, overriding existing parameters or injecting new ones.\nThe step-by-step attack flow proceeds as follows: First, an attacker leverages existing authorization to create or modify a ScaledObject or TriggerAuthentication resource within the Kubernetes cluster. Second, the attacker supplies malicious input containing control characters (such as newlines or carriage returns) combined with connection string directives within fields like host or sslmode. Third, KEDA's pkg/scalers/postgresql_scaler.go processes this input through the vulnerable escapePostgreConnectionParameter() function, generating a libpq-style connection string containing injected tokens. Fourth, when the PostgreSQL scaler attempts to establish a database connection using the pgx driver, the driver parses the manipulated string, injecting attacker-specified parameters. Finally, the connection is redirected to an attacker-controlled PostgreSQL instance, or TLS validation is bypassed by modifying sslmode, allowing the attacker to intercept authentication credentials or execute post-exploitation activities against the redirected traffic."
}