← Back

CVE-2026-55069

nvd nist
Published: Jun 26, 2026Modified: Jul 1, 2026

JSON object

Loading...
8.7
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Exploitability: 2.2 / Impact: 5.8
Source: security-advisories@github.com (Secondary)

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

Affected (1)

Products: Kestra: Kestra
Kestra
1 product
Kestra
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Kestra
Before 1.3.24

Related CWEs

CWE-916
Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (2)

Source: security-advisories@github.com
ExploitMitigationVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitMitigationVendor Advisory

Timeline

No history available yet.