CVE-2026-55069

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h	Exploit Mitigation Vendor Advisory
https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Kestra es una plataforma de orquestación de código abierto y basada en eventos. Anterior a la 1.3.24, esta vulnerabilidad existe en el componente de autenticación BasicAuth de la plataforma de orquestación de flujos de trabajo Kestra OSS. Un atacante que obtiene acceso de lectura a la base de datos PostgreSQL puede explotar la alta velocidad de cómputo de SHA-512 para recuperar la contraseña del administrador sin conexión. En despliegues de Kubernetes, un descifrado exitoso permite además la lectura del Token de ServiceAccount del clúster y de todos los Secrets de K8s, logrando una escalada de privilegios vertical. Esta vulnerabilidad está corregida en la versión 1.3.24.

Information

Published : 2026-06-26 22:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-55069

Mitre link : CVE-2026-55069

CVE.ORG link : CVE-2026-55069

JSON object : View

Products Affected

kestra

kestra

CWE

CWE-916

Use of Password Hash With Insufficient Computational Effort

{"id": "CVE-2026-55069", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55069", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-29T13:16:35.099360Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kestra-io", "product": "kestra", "versions": [{"status": "affected", "version": "< 1.3.24"}]}]}], "published": "2026-06-26T22:16:33.093", "references": [{"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-916"}]}], "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24."}, {"lang": "es", "value": "Kestra es una plataforma de orquestaci\u00f3n de c\u00f3digo abierto y basada en eventos. Anterior a la 1.3.24, esta vulnerabilidad existe en el componente de autenticaci\u00f3n BasicAuth de la plataforma de orquestaci\u00f3n de flujos de trabajo Kestra OSS. Un atacante que obtiene acceso de lectura a la base de datos PostgreSQL puede explotar la alta velocidad de c\u00f3mputo de SHA-512 para recuperar la contrase\u00f1a del administrador sin conexi\u00f3n. En despliegues de Kubernetes, un descifrado exitoso permite adem\u00e1s la lectura del Token de ServiceAccount del cl\u00faster y de todos los Secrets de K8s, logrando una escalada de privilegios vertical. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.3.24."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72648494-AC33-4C8C-B9C4-A203DCAB61D5", "versionEndExcluding": "1.3.24"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}