Package
keda-fips-2.19-metrics-apiserver
Component
github.com/kedacore/keda/v2
Latest update
5.9
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2026-53572 is a PostgreSQL connection-string parameter injection in pkg/scalers/postgresql_scaler.go of github.com/kedacore/keda/v2, fixed only in keda v2.20.0. The vulnerable code is not present in the keda-adapter binary shipped in this package: the adapter consumes metrics through the metrics-service gRPC client and never constructs scalers, so the Go linker dead-code-eliminates the entire PostgreSQL scaler; only the pkg/scalers package init functions survive, which is why the module version is still visible to the scanner. Verified with go tool nm on the shipped apk binaries for both architectures: no NewPostgreSQLScaler, postgreSQLScaler methods, parsePostgreSQLMetadata, getConnection, buildConnArray or escapePostgreConnectionParameter symbols are present, while the keda-2.19 operator binary (a true positive for this CVE) does contain them. The detection matches the Go module version stamp rather than the presence of vulnerable code.
Status