CVE-2026-34612

{"id": "CVE-2026-34612", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34612", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T16:10:07.676305Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kestra-io", "product": "kestra", "versions": [{"status": "affected", "version": "< 1.3.7"}]}]}], "published": "2026-04-03T23:17:04.587", "references": [{"url": "https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/releases/tag/v1.3.7", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint \"GET /api/v1/main/flows/search\". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7."}, {"lang": "es", "value": "Kestra es una plataforma de orquestaci\u00f3n de c\u00f3digo abierto y basada en eventos. Antes de la versi\u00f3n 1.3.7, Kestra (despliegue predeterminado de docker-compose) contiene una vulnerabilidad de inyecci\u00f3n SQL que conduce a ejecuci\u00f3n remota de c\u00f3digo (RCE) en el siguiente endpoint 'GET /api/v1/main/flows/search'. Una vez que un usuario est\u00e1 autenticado, basta con visitar un enlace manipulado para activar la vulnerabilidad. La carga \u00fatil inyectada es ejecutada por PostgreSQL utilizando COPY ... TO PROGRAM ..., lo que a su vez ejecuta comandos arbitrarios del sistema operativo en el host. Este problema ha sido parcheado en la versi\u00f3n 1.3.7."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EAC1A4D-3CFB-44C4-9EC1-3D27B2781397", "versionEndExcluding": "1.3.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}