CVE-2026-34612 Details
Description
Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.
A SQL injection vulnerability has been identified in Kestra, an open-source orchestration platform, prior to version 1.3.7. This vulnerability is present in the default docker-compose deployment and affects the endpoint 'GET /api/v1/main/flows/search'. Once authenticated, a user can trigger the vulnerability by visiting a crafted link. The injected SQL payload is executed by PostgreSQL using 'COPY ... TO PROGRAM ...', allowing the execution of arbitrary operating system commands on the host.
Users can upgrade to Kestra version 1.3.7 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3 | [email protected] | Patch |
| https://github.com/kestra-io/kestra/releases/tag/v1.3.7 | [email protected] | ProductRelease Notes |
| https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kestra kestra | < 1.3.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | New CVE Received | [email protected] |