CVE-2026-34612

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3	Patch
https://github.com/kestra-io/kestra/releases/tag/v1.3.7	Product Release Notes
https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x	Exploit Mitigation Vendor Advisory
https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-03 23:17

Updated : 2026-07-24 22:10

NVD link : CVE-2026-34612

Mitre link : CVE-2026-34612

CVE.ORG link : CVE-2026-34612

JSON object : View

Products Affected

kestra

kestra

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-34612", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34612", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T16:10:07.676305Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kestra-io", "product": "kestra", "versions": [{"status": "affected", "version": "< 1.3.7"}]}]}], "published": "2026-04-03T23:17:04.587", "references": [{"url": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint \"GET /api/v1/main/flows/search\". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7."}, {"lang": "es", "value": "Kestra es una plataforma de orquestaci\u00f3n de c\u00f3digo abierto y basada en eventos. Antes de la versi\u00f3n 1.3.7, Kestra (despliegue predeterminado de docker-compose) contiene una vulnerabilidad de inyecci\u00f3n SQL que conduce a ejecuci\u00f3n remota de c\u00f3digo (RCE) en el siguiente endpoint 'GET /api/v1/main/flows/search'. Una vez que un usuario est\u00e1 autenticado, basta con visitar un enlace manipulado para activar la vulnerabilidad. La carga \u00fatil inyectada es ejecutada por PostgreSQL utilizando COPY ... TO PROGRAM ..., lo que a su vez ejecuta comandos arbitrarios del sistema operativo en el host. Este problema ha sido parcheado en la versi\u00f3n 1.3.7."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EAC1A4D-3CFB-44C4-9EC1-3D27B2781397", "versionEndExcluding": "1.3.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}