SQL Injection Vulnerability in Kestra Event-Driven Orchestration Platform

CVE-2026-34612

What is CVE-2026-34612?

Kestra, an open-source orchestration platform, had a SQL Injection vulnerability in its default docker-compose deployment before version 1.3.7. This issue affected the endpoint 'GET /api/v1/main/flows/search'. An authenticated user could be exploited merely by visiting a specially crafted link, leading to Remote Code Execution (RCE). The vulnerability allowed attackers to execute arbitrary commands on the host OS through PostgreSQL's COPY ... TO PROGRAM function. The vulnerability has been addressed in version 1.3.7, and users are urged to upgrade to secure their systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References