CVE-2026-34612

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34612
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34612.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34612
Aliases
Published
2026-04-03T22:39:31.434Z
Modified
2026-08-05T08:33:20.896611Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Kestra: Remote Code Execution via SQL Injection
Details

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34612.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "1.3.7"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/kestra-io/kestra

Affected ranges

Type
GIT
Repo
https://github.com/kestra-io/kestra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3926762795df8ad3e03924b370c51832ed3a21d3
Fixed
a3b606fb5142e47026144e030c78daafc3f4a6dd
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v0.*
v0.0.1234
v0.19.0
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.9.0
v0.9.1
v1.*
v1.3.0
v1.3.0-rc0
v1.3.0-rc1
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34612.json"
vanir_signatures 
[
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "99166352086754999741931683356819477947",
            "length": 746.0
        },
        "id": "CVE-2026-34612-0ad693f1",
        "target": {
            "function": "findCondition",
            "file": "jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresFlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "160402424359191559790897662909167329365",
                "248886636873294342206840473223469066371",
                "52791296160580375393371701950743329241",
                "71596154988291988071586926680418490100",
                "28584482461301969170175114628058625516",
                "181830147116197341215468849111032326446",
                "120693497699163731411502900278974871931",
                "294648305334509801715082689527723474445",
                "254034350637869337452684929694646082080",
                "145671670335318513394467821967214462854",
                "62816743939966295454588687950264268674",
                "227003212100160518701456459890002534808",
                "132618977571139741747052949260551098403",
                "282909118582565956457730300553421151628"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-18581813",
        "target": {
            "file": "jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresFlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "85347634515155871623711212675912843127",
            "length": 570.0
        },
        "id": "CVE-2026-34612-187b3170",
        "target": {
            "function": "findCondition",
            "file": "jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlFlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "160402424359191559790897662909167329365",
                "248886636873294342206840473223469066371",
                "52791296160580375393371701950743329241",
                "71596154988291988071586926680418490100",
                "28584482461301969170175114628058625516",
                "24700463707875269127237339710197561207",
                "95139757336431924211060368435387332573",
                "125823599870280759764640494853082711505",
                "114764078651506820200441511194347654300",
                "198848842242792268693308340633336343600",
                "330060903196386187754464199191107857111",
                "336021401209648236745599557884784869433",
                "303003600913280123523208479201644905158"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-1b72a64c",
        "target": {
            "file": "jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "41005445456387300941326685755201291401",
                "20061955811899151472699231178524528748",
                "80275597643246378043942629226084145678",
                "101878982740887055126090933376147085525",
                "56987860356805707870086971729014284365",
                "294054552990110715608999498674348029056",
                "175182634084943151962658163645004514431",
                "304578101646215649848726612449791604006"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-24cab51d",
        "target": {
            "file": "jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlFlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "108083682963252960914583596735501445843",
            "length": 895.0
        },
        "id": "CVE-2026-34612-28d4ea8b",
        "target": {
            "function": "findCondition",
            "file": "jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlFlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "55220798594391659404690932421246683474",
                "275693323742339814276869185536936930204",
                "160908247249138808288891808952178070354",
                "175804330793717009546118543187701565481",
                "185672453252312518412777050585922978875",
                "85012280711622687398401298971479790974",
                "151833663803252858253438656221285821664",
                "256078206015828122521429259497007952163",
                "51244826581917155056699318457876147428",
                "65526552219497254361348479819732593256",
                "292349496333533311217023316245733036948",
                "4495977873560480439763082271154376748"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-2f047608",
        "target": {
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2RepositoryUtils.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "41005445456387300941326685755201291401",
                "20061955811899151472699231178524528748",
                "80275597643246378043942629226084145678",
                "101878982740887055126090933376147085525",
                "329316918902828317501881317226622395008",
                "309288292262157541414261314910396381946",
                "160606962354148650849401875556418078125",
                "134196396583335386868533050292238920587",
                "167056765069800265433905711338117602720",
                "289568930529047842823278355312096118788",
                "129356545833538931005814123209514190360",
                "143065642774017977573462223695427982321",
                "72126509315549685819276709261197472455",
                "299940896714725511265778200391771869191",
                "289265554221081747013961976944875178589"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-3584f1a1",
        "target": {
            "file": "jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "228074352147543011392809656406392517918",
                "136015407070185895717566352630135326436",
                "208836329270190860017158763107881885664",
                "286767485428053418218173908799181969881",
                "158935046314202311543957008318566668176",
                "159911564532922382791339270830072947757",
                "126449459813346873870611388608563928744",
                "20772904848514593492755069740824552692"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-51edd5d7",
        "target": {
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2ExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "334889633647778460288285788419155793115",
            "length": 731.0
        },
        "id": "CVE-2026-34612-60a0dd2b",
        "target": {
            "function": "findCondition",
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2FlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "253751280357285180146679028788852202170",
            "length": 496.0
        },
        "id": "CVE-2026-34612-78201d22",
        "target": {
            "function": "findCondition",
            "file": "jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "312811799420304191812485825269832225966",
            "length": 598.0
        },
        "id": "CVE-2026-34612-7fdb8c50",
        "target": {
            "function": "findCondition",
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2ExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "314244829746170334718511542715487873692",
                "162274744056828698823561920976781710031",
                "185932479959955833370733678669259936594"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-9f4e7d0e",
        "target": {
            "file": "core/src/test/java/io/kestra/core/repositories/AbstractExecutionRepositoryTest.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "302645513308695562357437984774027349822",
            "length": 1264.0
        },
        "id": "CVE-2026-34612-a25b4f42",
        "target": {
            "function": "findLabelCondition",
            "file": "jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "116789997219634523952602149633512559100",
            "length": 1167.0
        },
        "id": "CVE-2026-34612-b3bd3ee3",
        "target": {
            "function": "findLabelCondition",
            "file": "jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "312811799420304191812485825269832225966",
            "length": 598.0
        },
        "id": "CVE-2026-34612-d36f46f3",
        "target": {
            "function": "findCondition",
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2FlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "190450905273641511124281417541934539050",
            "length": 675.0
        },
        "id": "CVE-2026-34612-e59ba168",
        "target": {
            "function": "formatDateField",
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2RepositoryUtils.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "228074352147543011392809656406392517918",
                "136015407070185895717566352630135326436",
                "208836329270190860017158763107881885664",
                "286767485428053418218173908799181969881",
                "81307333644383837803072337736036199388",
                "323759540456548590331629391486583058005",
                "226983097171939547901781610439137409145",
                "182546755095730929408749245283202499984"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-34612-ef47394e",
        "target": {
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2FlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "253751280357285180146679028788852202170",
            "length": 496.0
        },
        "id": "CVE-2026-34612-f530d271",
        "target": {
            "function": "findCondition",
            "file": "jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresFlowRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "57135752952091706183871708149375476211",
            "length": 582.0
        },
        "id": "CVE-2026-34612-f8d9fdeb",
        "target": {
            "function": "findCondition",
            "file": "jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlExecutionRepositoryService.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "102527382380114762865555654047077750264",
            "length": 1446.0
        },
        "id": "CVE-2026-34612-fb673ec1",
        "target": {
            "function": "findLabelCondition",
            "file": "jdbc-h2/src/main/java/io/kestra/repository/h2/H2ExecutionRepositoryService.java"
        },
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-05T08:33:20Z"