What is the CVSS score of CVE-2026-55069?

CVE-2026-55069 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Kestra are affected by CVE-2026-55069?

A vulnerability in Kestra OSS (versions before 1.3.24) allows attackers with database read access to recover admin credentials offline, granting full administrative control and enabling cluster-wide…. A patch is available.

How to fix or mitigate CVE-2026-55069?

Within 24 hours: Audit PostgreSQL database access logs and identify all principals with read access to the Kestra instance; document when admin credentials were last changed. Evaluate whether production Kestra deployments control critical workflows or contain sensitive data. Within 7 days: Implement least-privilege database access (restrict to Kestra service accounts only); enable audit logging on database connections; rotate admin credentials; review Kubernetes RBAC policies to minimize the Kestra pod's access to cluster secrets. Monitor vendor advisories for patch availability. Within 30 days: Test upgrade path to Kestra 1.3.24 or later once released; if unavailable, evaluate alternative orchestration platforms or implement network segmentation to isolate the Kestra database from general cluster access.

Kestra CVE-2026-55069

EUVD-2026-39917 HIGH

Use of Password Hash With Insufficient Computational Effort (CWE-916)

2026-06-26 GitHub_M

Privilege Escalation Kubernetes PostgreSQL Kestra Kestra Io

8.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

AC:H because the attack depends on prior PostgreSQL read access plus offline cracking; S:C with C:H/I:H reflects the pivot to K8s ServiceAccount token and Secrets; A:N as availability is unaffected.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 23:02 EUVD

Analysis Generated

Jun 26, 2026 - 21:51 vuln.today

CVE Published

Jun 26, 2026 - 20:50 cve.org

HIGH 8.7

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

AnalysisAI

Offline administrator password recovery in Kestra OSS (versions prior to 1.3.24) stems from its BasicAuth component storing the admin credential as a fast SHA-512 hash. An attacker who already holds read access to the backing PostgreSQL database can extract that hash and crack it offline at high speed, then log in as administrator; in Kubernetes deployments this further exposes the cluster ServiceAccount token and all K8s Secrets, enabling vertical privilege escalation. No public exploit identified at time of analysis and not on CISA KEV; EPSS data was not provided.

Technical ContextAI

Kestra is an event-driven workflow orchestration platform whose built-in BasicAuth module authenticates the admin account. The root cause is CWE-916 (Use of Password Hash With Insufficient Computational Effort): SHA-512 is a general-purpose cryptographic digest designed to be fast, not a deliberately slow, memory-hard password KDF such as bcrypt, scrypt, or Argon2id. Because SHA-512 can be computed billions of times per second on commodity GPUs, any leaked credential hash becomes feasible to brute-force or dictionary-attack offline. The affected component is cpe:2.3:a:kestra-io:kestra (all versions before 1.3.24), and the credential material lives in the PostgreSQL backend Kestra uses for persistence.

RemediationAI

Vendor-released patch: 1.3.24 - upgrade Kestra to 1.3.24 or later, which addresses the weak password-hashing scheme, and rotate the administrator password after upgrading so any previously stored fast-hash value is replaced. As compensating controls until patched: tightly restrict and audit read access to the PostgreSQL database holding Kestra credentials (least-privilege DB accounts, network segmentation so only Kestra can reach the database, encryption at rest and of backups), since the entire attack depends on obtaining the stored hash; in Kubernetes, limit blast radius by scoping Kestra's ServiceAccount with minimal RBAC and avoiding broad Secret read permissions, accepting that this may reduce orchestration features that rely on cluster access. Enforce a long, high-entropy admin password to make offline cracking impractical even against fast SHA-512. Full details are in the vendor advisory at https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h.