The vulnerability originates from the PostgreSQL scaler component of KEDA, where user-supplied connection parameters are concatenated into a libpq-style connection string after only spaces are escaped. Because tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes are not treated as special characters, an attacker can inject arbitrary key‑value pairs into the string. By manipulating the host or sslmode parameters within a TriggerAuthentication or ScaledObject, the attacker can redirect the database connection to an attacker‑controlled server and expose credentials that would otherwise be protected by TLS. This injection does not rely on a prior PostgreSQL login; it merely diverts the connection at the client side, potentially leaking sensitive information. The weakness is a classic parameter injection flaw (CWE‑74/CWE‑89).

KEDA, developed by kedacore, is vulnerable on all releases before version 2.20.0. Any deployment that includes the PostgreSQL scaler using a TriggerAuthentication or ScaledObject with tenant-controlled values is affected. The fix was introduced in KEDA 2.20.0, which performs proper escaping of all connection string parameters. Objects built with earlier versions that have not been upgraded remain susceptible.

The CVSS base score of 5.9 signals moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation evidence. Exploitation requires the ability to create or modify TriggerAuthentication or ScaledObject custom resources within the Kubernetes cluster, typically implying a privileged or compromised user. If an attacker can achieve this, they can redirect database traffic and capture credentials. While unlikely to be exploited by unauthenticated external attackers, insider misuse or compromised cluster access could lead to credential loss or data exfiltration.