CVE-2026-55069 Details
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.
A vulnerability exists in the BasicAuth authentication component of the Kestra orchestration platform, prior to version 1.3.24. This issue arises because passwords are stored using SHA-512, a hash function that is fast and not suitable for password storage. An attacker with read access to the PostgreSQL database can exploit this to recover the administrator password offline. In Kubernetes deployments, this could lead to unauthorized access to the cluster's ServiceAccount Token and all K8s Secrets, allowing for vertical privilege escalation.
Users are advised to migrate to Kestra version 1.3.24 or later, where this vulnerability has been fixed. Additionally, consider using a strong, randomly generated password for BasicAuth to increase the time required to crack the password under SHA-512.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kestra kestra | < 1.3.24 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |