Package
keda-fips-2.19-admission-webhooks
Component
github.com/kedacore/keda/v2
Latest update
5.9
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2026-53572 is a PostgreSQL connection-string parameter injection in pkg/scalers/postgresql_scaler.go of github.com/kedacore/keda/v2, fixed only in keda v2.20.0. The vulnerable code is not present in the keda-admission-webhooks binary shipped in this package: cmd/webhooks does not import pkg/scalers at all (its keda-internal import closure is limited to the apis packages, pkg/k8s, pkg/metricscollector/webhook, pkg/util and version). Verified with go tool nm on the shipped apk binaries for both architectures: zero github.com/kedacore/keda/v2/pkg/scalers symbols are present, while the keda-2.19 operator binary (a true positive for this CVE) does contain the vulnerable functions. The detection matches the Go module version stamp rather than the presence of vulnerable code.
Status