CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Weak SHA-512 password hashing in Kestra allows offline brute-force attacks, potentially leading to privilege escalation and secret exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55069?
CVE-2026-55069 is a high-severity vulnerability in kestra-io kestra, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.
Weakness: CWE-916
Which versions are affected by CVE-2026-55069?
It affects 1 product.
Products include Kestra Kestra.
How do I fix CVE-2026-55069?
No fix has been published for CVE-2026-55069 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55069 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55069 exists.
Other vulnerabilities in kestra-io kestra
- CVE-2026-49869 Kestra OSS OS Command Injection
- CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
- CVE-2026-34612 Kestra: Remote Code Execution via SQL Injection
- CVE-2026-38428 SQL injection in n/a
- CVE-2026-45807 Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
Sources
Also known as GHSA-m727-pcjm-j28h.