CVE-2026-55069: Kestra Authentication Weakness Enables Admin Credential Recovery

Technical summary

CVE-2026-55069 affects Kestra's BasicAuth authentication component. The vulnerability stems from the use of SHA-512 hashing for password storage without adequate computational barriers (likely missing salt or iteration counts sufficient to resist modern GPU-accelerated cracking). An attacker who obtains read access to the underlying PostgreSQL database can extract password hashes and perform offline dictionary or brute-force attacks. SHA-512 alone, without PBKDF2, bcrypt, or Argon2 stretching, is computationally tractable on modern hardware. In Kubernetes deployments, successful compromise of the administrator account enables reading of the cluster's ServiceAccount Token and Kubernetes Secrets, facilitating lateral movement and privilege escalation across the cluster.

Business impact

Organizations deploying Kestra as a central orchestration hub face significant risk. Workflow orchestration platforms typically integrate with numerous downstream systems, databases, and APIs. An attacker gaining admin access through password recovery can modify workflows, exfiltrate data passing through the platform, disable critical automation, or pivot to connected infrastructure. In Kubernetes environments, the ability to read cluster tokens and secrets compounds the impact by enabling compromise of containerized workloads, persistent storage, and external service integrations.

Affected systems

Kestra open-source versions prior to 1.3.24 are affected. The vulnerability is specific to deployments using BasicAuth authentication. Organizations running Kestra in Kubernetes clusters face elevated risk due to the lateral escalation potential to cluster-wide resources. Self-hosted and cloud-deployed instances are both vulnerable if they use the affected authentication component.

Exploitability

Exploitation requires initial read access to the PostgreSQL database. This could arise from misconfigured database permissions, exposed backups, or a secondary breach. The attack surface for obtaining database access depends on the deployment architecture. Once database access is gained, the password cracking phase is entirely offline and requires no further interaction with live systems, making detection difficult. The CVSS score of 8.7 (HIGH) reflects the high impact of successful exploitation balanced against the moderate barrier of requiring prior database access.

Remediation

Upgrade Kestra to version 1.3.24 or later immediately. This version includes fixes to the BasicAuth component. After upgrading, reset all administrator and service account passwords to clear any previously cracked credentials. In Kubernetes environments, rotate all ServiceAccount tokens and review Secret access logs. Audit database access logs for unauthorized reads and verify that database credentials themselves have not been compromised.

Patch guidance

Apply Kestra 1.3.24 as soon as possible. Verify the upgrade in a non-production environment first to ensure compatibility with your workflows and integrations. The patch should be deployed to all instances, including both primary and replica/failover deployments. If you cannot immediately upgrade, implement strict database access controls and enable audit logging on your PostgreSQL instance to detect unauthorized access attempts.

Detection guidance

Monitor PostgreSQL query logs for unusual SELECT statements targeting authentication tables (typically containing password hashes). In Kubernetes environments, enable audit logging and alert on reads of Secrets or access to ServiceAccount tokens that deviate from normal patterns. Search logs for authentication failures followed by privilege escalation events. Network detection should flag unexpected outbound connections from Kestra instances to password cracking services or external command-and-control infrastructure. Review container image hashes and process execution logs for signs of runtime compromise post-authentication.

Why prioritize this

This vulnerability merits urgent prioritization despite not yet appearing on CISA's Known Exploited Vulnerabilities (KEV) catalog. The combination of high impact (admin access + Kubernetes cluster compromise), realistic attack prerequisites (database access is achievable through multiple vectors), and the platform's role as a potential hub for critical workflows creates substantial organizational risk. Organizations running Kestra in production should treat 1.3.24 adoption as a critical maintenance task.

Risk score, explained

The CVSS 8.7 HIGH score appropriately reflects the high confidentiality and integrity impact balanced against a moderate attack complexity (AC:H) due to the requirement for prior database access. The network-accessible vector (AV:N) acknowledges that database breaches can stem from externally exploitable weaknesses. The scope change (S:C) correctly indicates that successful exploitation can impact resources beyond the vulnerable component—specifically, downstream systems accessible to the compromised orchestration platform and, in Kubernetes, the broader cluster.

Frequently asked questions