CVE-2026-55069

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.3.24

Description The BasicAuth authentication component of the Kestra OSS workflow orchestration platform stores passwords using SHA-512, which has a high computation speed. An attacker with read access to the PostgreSQL database can perform an offline brute-force attack to recover the administrator password. In Kubernetes deployments, this can lead to vertical privilege escalation by allowing the attacker to read the cluster ServiceAccount Token and all K8s Secrets.

Recommendations Update to version 1.3.24.