CVE-2026-34612
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Kestra prior to version 1.3.7 contains a SQL injection vulnerability in the GET /api/v1/main/flows/search endpoint, allowing an authenticated attacker to achieve remote code execution via PostgreSQL COPY ... TO PROGRAM.
Risk Assessment
An attacker can execute arbitrary OS commands on the host, leading to full system compromise and potential lateral movement.
Recommendation
Immediately update to version 1.3.7 or later and restrict access to the endpoint to trusted users only.
Original NVD description (English source)
Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.