CVE-2026-34612 - Exploits & Severity

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

SQL Injection vulnerability in Kestra (open-source, event-driven orchestration platform) versions prior to 1.3.7. The vulnerability exists in the GET /api/v1/main/flows/ endpoint in the default Docker Compose deployment. The injected SQL payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., enabling arbitrary OS command execution.

An authenticated user can visit a crafted link to trigger the vulnerability, leading to Remote Code Execution (RCE) on the host system. The attacker can execute arbitrary OS commands with the privileges of the PostgreSQL process. This results in potential complete compromise of confidentiality, integrity, and availability of the affected system and potentially connected systems (CVSS 9.9).

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patches are available. Upgrade Kestra to version 1.3.7 or later.

Immediately upgrade Kestra to version 1.3.7 or later. Until patching is possible, restrict network access to Kestra instances and limit access to authenticated users only. Implement network segmentation to isolate affected systems.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD published the first details for CVE-2026-34612

A CVSS base score of 9.9 has been assigned.

Feedly found the first article mentioning CVE-2026-34612 . See article

CVE-2026-34612 is a critical SQL Injection vulnerability in Kestra, with a CVSS score of 9.9, allowing for Remote Code Execution on affected systems prior to version 1.3.7, particularly in default docker-compose setups. Exploitation requires authenticated access, and while no public proof-of-concept exists, attackers can trigger the vulnerability via a crafted link. Users are advised to upgrade to version 1.3.7 or newer to mitigate the risk. See article

Kestra RCE via Authenticated SQL Injection (CVE-2026-34612)

CVE-2026-34612: Security Advisory: CVE-2026-34612

CVE-2026-34612 | kestra-io kestra up to 1.3.6 Endpoint sql injection (GHSA-365w-2m69-mp9x)

Report: Update: CVE-2026-34612 - Kestra: Remote Code Execution via SQL Injection

Collect, analyze, and vulnerability reports faster using AI