The vulnerability exists in the function escapePostgreConnectionParameter in pkg/scalers/postgresql_scaler.go, which only escapes parameters containing literal spaces but ignores other ASCII whitespace characters (tabs, newlines, carriage returns, form feeds). Since libpq connection strings separate parameters by any whitespace, an attacker can inject additional key=value pairs by including these characters in tenant-controllable fields (host, port, userName, dbName, sslmode). This leads to injection of parameters such as sslmode=disable or host=attacker.example.com, enabling silent TLS downgrade and redirection of connections to attacker-controlled hosts, potentially exposing credentials. The password parameter is appended last, limiting but not eliminating credential theft. The suggested fix is to escape or reject all ASCII whitespace and backslashes, prefer URI connection strings with URL encoding, and validate inputs against allow-lists.

An attacker able to supply connection parameters can silently downgrade TLS connections by forcing sslmode=disable, redirect connections to attacker-controlled hosts to capture credentials, and append arbitrary libpq parameters to alter connection behavior. This compromises confidentiality by enabling man-in-the-middle attacks and credential theft. The attack requires low privileges (ability to create TriggerAuthentication or ScaledObject with crafted parameters) but can have high confidentiality impact. Integrity impact is limited to connection parameter manipulation; availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input in PostgreSQL connection parameters or sanitize inputs to reject or escape all ASCII whitespace characters (including tabs, newlines, carriage returns, form feeds, vertical tabs) and backslashes. Prefer using URI-style PostgreSQL connection strings with proper URL encoding. Validate all tenant-supplied fields against strict allow-list patterns before use.