What’s Vulnerable › Vulnerabilities

CVE-2026-55069: Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

• Severity: high (CVSS 8.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-26 · updated 2026-10-25
• Weakness: CWE-916

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

Affected products

• kestra-io kestra: before 1.3.24 — fixed in 1.3.24

How to fix

Upgrade to a fixed version: kestra-io kestra 1.3.24. Check the vendor advisory for mitigations.

References

• https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h
• https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h

Get alerted when CVE-2026-55069 or the next vulnerability affects your stack