CVE-2026-38428

CriticalCVSS 9.8

Published: 05/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

Kestra version 1.3.3 and earlier is vulnerable to SQL injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization.

Risk Assessment

An attacker can inject arbitrary SQL expressions into the database query, potentially leading to data leakage or modification.

Recommendation

Update Kestra to a version later than 1.3.3 that includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.