CVE-2026-55069

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55069
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55069.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55069
Aliases
  • GHSA-m727-pcjm-j28h
Published
2026-06-26T20:50:09.954Z
Modified
2026-07-15T15:53:48.199311Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Details

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

Database specific 
{
    "cwe_ids": [
        "CWE-916"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55069.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/kestra-io/kestra

Affected ranges

Type
GIT
Repo
https://github.com/kestra-io/kestra
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630
Database specific 
{
    "cpe": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.24"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*
v0.0.1234
v0.19.0
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.9.0
v0.9.1
v1.*
v1.3.0
v1.3.0-rc0
v1.3.0-rc1
v1.3.1
v1.3.11
v1.3.13
v1.3.14
v1.3.15
v1.3.16
v1.3.17
v1.3.18
v1.3.19
v1.3.2
v1.3.20
v1.3.21
v1.3.22
v1.3.23
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.3.9

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "140357562688538205345254706729617935184",
                "304622577954603750062645385810567482955",
                "172583391333871376895219175659680168624",
                "183202715105275968527562296723581938117",
                "297530466543600923085808142532015000696",
                "166130564697929043102664410002815835326"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-55069-ae852aa8",
        "target": {
            "file": "executor/src/main/java/io/kestra/executor/ExecutorService.java"
        }
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "114665094312657875926090929902087966387",
                "274801199915747080465899563020440974966",
                "162451514141723112063978488641837120054",
                "311266650890310641974077291142530475109",
                "36923110329716295121989747954185703358",
                "25482173696437418952014903161456696174"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-55069-b849bba4",
        "target": {
            "file": "webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java"
        }
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "290069323323167062483700325176558449078",
            "length": 1430.0
        },
        "deprecated": false,
        "id": "CVE-2026-55069-c95e9421",
        "target": {
            "function": "shouldRunFlowableAfterExecutionWhenExecutionIsKilled",
            "file": "webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java"
        }
    },
    {
        "source": "https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "164146531972406519589227532778007779872",
            "length": 1414.0
        },
        "deprecated": false,
        "id": "CVE-2026-55069-d6418229",
        "target": {
            "function": "process",
            "file": "executor/src/main/java/io/kestra/executor/ExecutorService.java"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T15:53:48Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55069.json"