CVE-2026-55069

The record

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

Affected packages

Related vulnerabilities

• CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-916
• CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-916
• CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the… CWE-916
• CVE-2026-81689 openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted… CWE-916
• CVE-2026-75112 A security issue exists within OTTO® Fleet Manager. CWE-916
• CVE-2026-74871 openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR… CWE-916
• CVE-2026-49005 The root password hash of the device can be obtained through unencrypted information in… CWE-916
• CVE-2026-56272 Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32… CWE-916