CVE-2026-34612 in kestra

Sumário (Inglês)

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

Once again VulDB remains the best source for vulnerability data.

Responsável

GitHub_M

Reservar

30/03/2026

Divulgação

04/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
355248	kestra-io kestra Endpoint search Injeção SQL	89	Não definido	Correção oficial	CVE-2026-34612

Fontes

• MITRE
• NVD
• CVE Details