CVE-2026-34612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34612", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T17:15:52.501Z", "datePublished": "2026-04-03T22:39:31.434Z", "dateUpdated": "2026-04-06T16:10:10.415Z"}, "containers": {"cna": {"title": "Kestra: Remote Code Execution via SQL Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x"}, {"name": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3", "tags": ["x_refsource_MISC"], "url": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3"}, {"name": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7"}], "affected": [{"vendor": "kestra-io", "product": "kestra", "versions": [{"version": "< 1.3.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T22:39:31.434Z"}, "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint \"GET /api/v1/main/flows/search\". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7."}], "source": {"advisory": "GHSA-365w-2m69-mp9x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T16:10:07.676305Z", "id": "CVE-2026-34612", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:10:10.415Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34612", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T16:10:07.676305Z"}}}], "references": [{"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:10:00.329Z"}}], "cna": {"title": "Kestra: Remote Code Execution via SQL Injection", "source": {"advisory": "GHSA-365w-2m69-mp9x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kestra-io", "product": "kestra", "versions": [{"status": "affected", "version": "< 1.3.7"}]}], "references": [{"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "name": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3", "name": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7", "name": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint \"GET /api/v1/main/flows/search\". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T22:39:31.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34612", "state": "PUBLISHED", "dateUpdated": "2026-04-06T16:10:10.415Z", "dateReserved": "2026-03-30T17:15:52.501Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-03T22:39:31.434Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kestra", "vendor": "kestra-io", "versions": [{"status": "affected", "version": "< 1.3.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EAC1A4D-3CFB-44C4-9EC1-3D27B2781397", "versionEndExcluding": "1.3.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint \"GET /api/v1/main/flows/search\". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7."}, {"lang": "es", "value": "Kestra es una plataforma de orquestaci\u00f3n de c\u00f3digo abierto y basada en eventos. Antes de la versi\u00f3n 1.3.7, Kestra (despliegue predeterminado de docker-compose) contiene una vulnerabilidad de inyecci\u00f3n SQL que conduce a ejecuci\u00f3n remota de c\u00f3digo (RCE) en el siguiente endpoint 'GET /api/v1/main/flows/search'. Una vez que un usuario est\u00e1 autenticado, basta con visitar un enlace manipulado para activar la vulnerabilidad. La carga \u00fatil inyectada es ejecutada por PostgreSQL utilizando COPY ... TO PROGRAM ..., lo que a su vez ejecuta comandos arbitrarios del sistema operativo en el host. Este problema ha sido parcheado en la versi\u00f3n 1.3.7."}], "id": "CVE-2026-34612", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34612", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T16:10:07.676305Z", "version": "2.0.3"}}]}, "published": "2026-04-03T23:17:04.587", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kestra", "source": "cna", "vendor": "kestra-io"}, "product": "kestra", "vendor": "kestra-io"}], "analysis": {"en": {"generated_at": "2026-04-13T18:26:24.478416+00:00", "value": {"mitigation_remediation": ["Apply the official patch by upgrading to Kestra v1.3.7 or later", "Verify that the \"GET /api/v1/main/flows/search\" endpoint is still accessible only to authorized users", "Check PostgreSQL configuration to ensure COPY \u2026 TO PROGRAM is not exploitable if upgrade is delayed", "Monitor system logs for suspicious SQL execution attempts"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all releases of the Kestra event\u2011driven orchestration platform prior to version 1.3.7, specifically the default Docker\u2011compose deployment. The affected product is Kestra.io\u2019s Kestra server. Upgrading to v1.3.7 or later eliminates the flaw.", "description_and_impact": "Kestra allows a malicious attacker who is already authenticated to inject an arbitrary SQL payload into the \"GET /api/v1/main/flows/search\" endpoint. The backend executes this payload via PostgreSQL's COPY \u2026 TO PROGRAM clause, which runs arbitrary OS commands on the host. The result is full remote code execution, giving an attacker the same privileges as the process running the Kestra service.", "risk_and_exploitability": "With a CVSS score of 10, the issue is considered critical. Exploitation requires a legitimate authentication token and crafted URL, making it an authenticated remote exploit. The EPSS score is below 1\u202f%, indicating low observed exploitation likelihood, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, the high severity combined with the possibility of arbitrary code execution warrants urgent action."}}}}, "created": "2026-04-06T21:22:03.505325+00:00", "updated": "2026-04-14T16:41:33.143423+00:00", "vendors": ["kestra-io", "kestra-io$PRODUCT$kestra"]}