Executive brief
KEDA, an event-driven autoscaler for Kubernetes, is vulnerable to a connection string injection flaw in its PostgreSQL scaler. An attacker with permission to configure scaling objects can inject malicious parameters into database connection strings. This could allow an attacker to redirect database traffic to a server they control to steal credentials or downgrade security settings to intercept sensitive data.
Technical details
The PostgreSQL scaler in KEDA builds libpq-style connection strings by concatenating key-value pairs. The 'escapePostgreConnectionParameter' function in 'pkg/scalers/postgresql_scaler.go' only checks for and escapes literal spaces, failing to account for other valid libpq delimiters such as tabs (\t), newlines (\n), and carriage returns (\r). A remote attacker with low privileges (ability to create ScaledObjects or TriggerAuthentications) can use these characters to inject additional parameters like 'host=' or 'sslmode=disable'. This can be used to redirect connections to an attacker-controlled host for credential harvesting or to perform man-in-the-middle attacks by disabling TLS. The issue is fixed in version 2.20.0.
Affected products
- kedacore KEDA < 2.20.0
Timeline
- 2026-06-01: disclosed
- 2026-07-07: advisory
- 2026-07-07: patched