Back Mondoo

CVE-2026-34612

Mondoo • April 4, 2026

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/ ". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Kestra (CVE-2026-34612) A critical SQL Injection vulnerability, identified as CVE-2026-34612, affects Kestra versions prior to 1.3.7. This vulnerability exists in the GET /api/v1/main/flows/ endpoint of the default Docker Compose deployment, allowing authenticated users to execute arbitrary OS commands on the host system via crafted links. The vulnerability is classified with a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability. Although no public proof-of-concept or evidence of exploitation has been reported, the potential for Remote Code Execution (RCE) poses a significant threat. Users are strongly advised to upgrade to version 1.3.7 or later to mitigate the risk. Until patching is feasible, restricting network access and implementing network segmentation are recommended. The CVE was published on April 3, 2026, and patches are available. 2 sources 74

Extracted Entities

CVE-2026-34612

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (2)