Is CVE-2026-53572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53572 being exploited in the wild.

How severe is CVE-2026-53572?

Medium severity, with a CVSS score of 5.9, published 21 August 2026.

Which products and versions are affected?

github.com/kedacore/keda (Go) SEMVER:introduced=0; github.com/kedacore/keda/v2 (Go) < 2.20.0, SEMVER:introduced=0,fixed=2.20.0; KEDAcore KEDA < 2.20.0.

Is there a fix for CVE-2026-53572?

Yes. github.com/kedacore/keda/v2 (Go): upgrade to 2.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53572 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53572?

Check whether you run github.com/kedacore/keda (Go), github.com/kedacore/keda/v2 (Go) or KEDAcore KEDA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53572: KEDA PostgreSQL scaler connection string parameter injection

Q: Is there a fix for CVE-2026-53572?

Yes. github.com/kedacore/keda/v2 (Go): upgrade to 2.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53572 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53572?

Check whether you run github.com/kedacore/keda (Go), github.com/kedacore/keda/v2 (Go) or KEDAcore KEDA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53572 · Severity: medium · CVSS 5.9 · Published 2026-08-21

KEDA, an event-driven autoscaler for Kubernetes, is vulnerable to a connection string injection flaw in its PostgreSQL scaler. An attacker with permission to configure scaling objects can inject malicious parameters into database connection strings. This could allow an attacker to redirect database traffic to a server they control to steal credentials or downgrade security settings to intercept sensitive data.

Technologies: github.com/kedacore/keda (Go), github.com/kedacore/keda/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-53572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53572 being exploited in the wild.
How severe is CVE-2026-53572?: Medium severity, with a CVSS score of 5.9, published 21 August 2026.
Which products and versions are affected?: github.com/kedacore/keda (Go) SEMVER:introduced=0; github.com/kedacore/keda/v2 (Go) < 2.20.0, SEMVER:introduced=0,fixed=2.20.0; KEDAcore KEDA < 2.20.0.
Is there a fix for CVE-2026-53572?: Yes. github.com/kedacore/keda/v2 (Go): upgrade to 2.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53572 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53572?: Check whether you run github.com/kedacore/keda (Go), github.com/kedacore/keda/v2 (Go) or KEDAcore KEDA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kedacore/keda/v2 (Go): upgrade to 2.20.0 or later
```
go get github.com/kedacore/keda/v2@v2.20.0
```

Technical details

The PostgreSQL scaler in KEDA builds libpq-style connection strings by concatenating key-value pairs. The 'escapePostgreConnectionParameter' function in 'pkg/scalers/postgresql_scaler.go' only checks for and escapes literal spaces, failing to account for other valid libpq delimiters such as tabs (\t), newlines (\n), and carriage returns (\r). A remote attacker with low privileges (ability to create ScaledObjects or TriggerAuthentications) can use these characters to inject additional parameters like 'host=' or 'sslmode=disable'. This can be used to redirect connections to an attacker-controlled host for credential harvesting or to perform man-in-the-middle attacks by disabling TLS. The issue is fixed in version 2.20.0.

Affected products

kedacore KEDA < 2.20.0

Identifiers

CVE-2026-53572
GHSA-6w3m-4hhp-775q
GO-2026-5940

Timeline

2026-06-01: disclosed
2026-07-07: advisory
2026-07-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.