Critical SQL Injection Vulnerability in Kestra (CVE-2026-34612)

Mondoo

Critical SQL Injection Vulnerability in Kestra (CVE-2026-34612)

First seen 5 Apr 2026, 02:30 UTC • •74.0

Article Content

1 / 3

Browse articles

ThreatCluster •April 6, 2026 at 02:13 UTC

•CVE-2026-34612 is a critical SQL Injection vulnerability in Kestra affecting versions prior to 1.3.7.
•The vulnerability allows authenticated users to trigger Remote Code Execution via crafted links.
•Users are advised to upgrade to version 1.3.7 immediately to mitigate risks.

A critical SQL Injection vulnerability, identified as CVE-2026-34612, affects Kestra versions prior to 1.3.7. This vulnerability exists in the GET /api/v1/main/flows/ endpoint of the default Docker Compose deployment, allowing authenticated users to execute arbitrary OS commands on the host system via crafted links. The vulnerability is classified with a CVSS score of 9.9, indicating a severe risk to confidentiality, integrity, and availability. Although no public proof-of-concept or evidence of exploitation has been reported, the potential for Remote Code Execution (RCE) poses a significant threat. Users are strongly advised to upgrade to version 1.3.7 or later to mitigate the risk. Until patching is feasible, restricting network access and implementing network segmentation are recommended. The CVE was published on April 3, 2026, and patches are available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 193d ago How this analysis works

Timeline

2026-04-03

CVE-2026-34612 published

2026-04-04

Articles published detailing the vulnerability and its impact

More articles in this cluster (2)

Threat Graph

8 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Sql Injection
T1059 - Command and Scripting Interpreter
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-34612

Affected Platform (3)

Docker Compose
Kestra
PostgreSQL

Tool (1)

Docker

Relationships

Docker exploits CVE-2026-34612
CVE-2026-34612 targets Docker Compose
CVE-2026-34612 targets Kestra
CVE-2026-34612 targets PostgreSQL
Sql Injection targets Docker Compose
Sql Injection targets Kestra
Sql Injection targets PostgreSQL
T1059 - Command and Scripting Interpreter targets Docker Compose
T1059 - Command and Scripting Interpreter targets Kestra
T1059 - Command and Scripting Interpreter targets PostgreSQL
T1190 - Exploit Public-Facing Application targets Docker Compose
T1190 - Exploit Public-Facing Application targets Kestra
T1190 - Exploit Public-Facing Application targets PostgreSQL

Following this threat?

Track CVE-2026-34612 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…