CVE-2026-55069

{
  "id": "CVE-2026-55069",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T22:16:33.093",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24."
    },
    {
      "lang": "es",
      "value": "Kestra es una plataforma de orquestación de código abierto y basada en eventos. Anterior a la 1.3.24, esta vulnerabilidad existe en el componente de autenticación BasicAuth de la plataforma de orquestación de flujos de trabajo Kestra OSS. Un atacante que obtiene acceso de lectura a la base de datos PostgreSQL puede explotar la alta velocidad de cómputo de SHA-512 para recuperar la contraseña del administrador sin conexión. En despliegues de Kubernetes, un descifrado exitoso permite además la lectura del Token de ServiceAccount del clúster y de todos los Secrets de K8s, logrando una escalada de privilegios vertical. Esta vulnerabilidad está corregida en la versión 1.3.24."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kestra-io",
          "product": "kestra",
          "versions": [
            {
              "version": "< 1.3.24",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T13:16:35.099360Z",
          "id": "CVE-2026-55069",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-916"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.3.24",
              "matchCriteriaId": "72648494-AC33-4C8C-B9C4-A203DCAB61D5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}