CVE-2026-34612 Kestra: Remote Code Execution via SQL Injection

What is CVE-2026-34612?

CVE-2026-34612 is a critical SQL injection vulnerability in kestra-io kestra, published on 3 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

Weakness: CWE-89

Which versions are affected by CVE-2026-34612?

It affects 1 product.

Products include Kestra Kestra.

How do I fix CVE-2026-34612?

No fix has been published for CVE-2026-34612 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-34612 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34612 exists.

Other vulnerabilities in kestra-io kestra

• CVE-2026-49869 Kestra OSS OS Command Injection Exploited Critical 10.0
• CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass Critical 10.0
• CVE-2026-38428 SQL injection in n/a Critical 9.8
• CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack High 8.7
• CVE-2026-45807 Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read High 7.7

Sources

• CVE record
• NVD
• OSV
• How this page is made