EUVD-2026-27426
GHSA-9jrq-5wf3-m9fp
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
AnalysisAI
SQL injection in Kestra workflow orchestration platform versions 1.3.3 and earlier enables remote unauthenticated attackers to execute arbitrary SQL commands and fully compromise the application database. The vulnerability stems from unsanitized GET parameters directly concatenated into SQL queries, allowing complete data exfiltration, modification, and potential database server compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all instances of Kestra version 1.3.3 and earlier in your environment using asset inventory and configuration management tools; disable or isolate affected instances from production networks if patch unavailable. Within 7 days: Contact Kestra vendor for available patch version and apply to all affected systems; if patch released, deploy to version 1.3.4 or later as documented in vendor advisory. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today