{"id":"CVE-2026-34612","summary":"Kestra: Remote Code Execution via SQL Injection","details":"Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint \"GET /api/v1/main/flows/search\". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.","aliases":["CVE-2026-38428","GHSA-365w-2m69-mp9x"],"modified":"2026-08-05T08:33:20.896611Z","published":"2026-04-03T22:39:31.434Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34612.json","unresolved_ranges":[{"extracted_events":[{"fixed":"1.3.7"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/kestra-io/kestra/releases/tag/v1.3.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34612.json"},{"type":"ADVISORY","url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34612"},{"type":"FIX","url":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kestra-io/kestra","events":[{"introduced":"0"},{"fixed":"3926762795df8ad3e03924b370c51832ed3a21d3"},{"fixed":"a3b606fb5142e47026144e030c78daafc3f4a6dd"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.3.0-rc1","v1.3.0-rc0","v0.0.1234","v0.19.0","v0.9.1","v0.9.0","v0.8.1","v0.8.0","v0.7.1","v0.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34612.json","vanir_signatures_modified":"2026-08-05T08:33:20Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"99166352086754999741931683356819477947","length":746},"id":"CVE-2026-34612-0ad693f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"function":"findCondition","file":"jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresFlowRepositoryService.java"}},{"digest":{"threshold":0.9,"line_hashes":["160402424359191559790897662909167329365","248886636873294342206840473223469066371","52791296160580375393371701950743329241","71596154988291988071586926680418490100","28584482461301969170175114628058625516","181830147116197341215468849111032326446","120693497699163731411502900278974871931","294648305334509801715082689527723474445","254034350637869337452684929694646082080","145671670335318513394467821967214462854","62816743939966295454588687950264268674","227003212100160518701456459890002534808","132618977571139741747052949260551098403","282909118582565956457730300553421151628"]},"id":"CVE-2026-34612-18581813","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresFlowRepositoryService.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"85347634515155871623711212675912843127","length":570},"id":"CVE-2026-34612-187b3170","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlFlowRepositoryService.java","function":"findCondition"}},{"deprecated":false,"digest":{"line_hashes":["160402424359191559790897662909167329365","248886636873294342206840473223469066371","52791296160580375393371701950743329241","71596154988291988071586926680418490100","28584482461301969170175114628058625516","24700463707875269127237339710197561207","95139757336431924211060368435387332573","125823599870280759764640494853082711505","114764078651506820200441511194347654300","198848842242792268693308340633336343600","330060903196386187754464199191107857111","336021401209648236745599557884784869433","303003600913280123523208479201644905158"],"threshold":0.9},"id":"CVE-2026-34612-1b72a64c","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresExecutionRepositoryService.java"}},{"source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlFlowRepositoryService.java"},"deprecated":false,"digest":{"line_hashes":["41005445456387300941326685755201291401","20061955811899151472699231178524528748","80275597643246378043942629226084145678","101878982740887055126090933376147085525","56987860356805707870086971729014284365","294054552990110715608999498674348029056","175182634084943151962658163645004514431","304578101646215649848726612449791604006"],"threshold":0.9},"id":"CVE-2026-34612-24cab51d","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-34612-28d4ea8b","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlFlowRepositoryService.java","function":"findCondition"},"deprecated":false,"digest":{"function_hash":"108083682963252960914583596735501445843","length":895}},{"signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2RepositoryUtils.java"},"deprecated":false,"digest":{"line_hashes":["55220798594391659404690932421246683474","275693323742339814276869185536936930204","160908247249138808288891808952178070354","175804330793717009546118543187701565481","185672453252312518412777050585922978875","85012280711622687398401298971479790974","151833663803252858253438656221285821664","256078206015828122521429259497007952163","51244826581917155056699318457876147428","65526552219497254361348479819732593256","292349496333533311217023316245733036948","4495977873560480439763082271154376748"],"threshold":0.9},"id":"CVE-2026-34612-2f047608","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["41005445456387300941326685755201291401","20061955811899151472699231178524528748","80275597643246378043942629226084145678","101878982740887055126090933376147085525","329316918902828317501881317226622395008","309288292262157541414261314910396381946","160606962354148650849401875556418078125","134196396583335386868533050292238920587","167056765069800265433905711338117602720","289568930529047842823278355312096118788","129356545833538931005814123209514190360","143065642774017977573462223695427982321","72126509315549685819276709261197472455","299940896714725511265778200391771869191","289265554221081747013961976944875178589"],"threshold":0.9},"id":"CVE-2026-34612-3584f1a1","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlExecutionRepositoryService.java"}},{"deprecated":false,"digest":{"line_hashes":["228074352147543011392809656406392517918","136015407070185895717566352630135326436","208836329270190860017158763107881885664","286767485428053418218173908799181969881","158935046314202311543957008318566668176","159911564532922382791339270830072947757","126449459813346873870611388608563928744","20772904848514593492755069740824552692"],"threshold":0.9},"id":"CVE-2026-34612-51edd5d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2ExecutionRepositoryService.java"}},{"digest":{"function_hash":"334889633647778460288285788419155793115","length":731},"id":"CVE-2026-34612-60a0dd2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"function":"findCondition","file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2FlowRepositoryService.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"253751280357285180146679028788852202170","length":496},"id":"CVE-2026-34612-78201d22","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresExecutionRepositoryService.java","function":"findCondition"}},{"target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2ExecutionRepositoryService.java","function":"findCondition"},"deprecated":false,"digest":{"length":598,"function_hash":"312811799420304191812485825269832225966"},"id":"CVE-2026-34612-7fdb8c50","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3"},{"digest":{"line_hashes":["314244829746170334718511542715487873692","162274744056828698823561920976781710031","185932479959955833370733678669259936594"],"threshold":0.9},"id":"CVE-2026-34612-9f4e7d0e","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"core/src/test/java/io/kestra/core/repositories/AbstractExecutionRepositoryTest.java"},"deprecated":false},{"target":{"file":"jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresExecutionRepositoryService.java","function":"findLabelCondition"},"deprecated":false,"digest":{"function_hash":"302645513308695562357437984774027349822","length":1264},"id":"CVE-2026-34612-a25b4f42","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3"},{"source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlExecutionRepositoryService.java","function":"findLabelCondition"},"deprecated":false,"digest":{"function_hash":"116789997219634523952602149633512559100","length":1167},"id":"CVE-2026-34612-b3bd3ee3","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2FlowRepositoryService.java","function":"findCondition"},"deprecated":false,"digest":{"length":598,"function_hash":"312811799420304191812485825269832225966"},"id":"CVE-2026-34612-d36f46f3","signature_type":"Function"},{"id":"CVE-2026-34612-e59ba168","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2RepositoryUtils.java","function":"formatDateField"},"deprecated":false,"digest":{"function_hash":"190450905273641511124281417541934539050","length":675}},{"deprecated":false,"digest":{"line_hashes":["228074352147543011392809656406392517918","136015407070185895717566352630135326436","208836329270190860017158763107881885664","286767485428053418218173908799181969881","81307333644383837803072337736036199388","323759540456548590331629391486583058005","226983097171939547901781610439137409145","182546755095730929408749245283202499984"],"threshold":0.9},"id":"CVE-2026-34612-ef47394e","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2FlowRepositoryService.java"}},{"id":"CVE-2026-34612-f530d271","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-postgres/src/main/java/io/kestra/repository/postgres/PostgresFlowRepositoryService.java","function":"findCondition"},"deprecated":false,"digest":{"function_hash":"253751280357285180146679028788852202170","length":496}},{"source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-mysql/src/main/java/io/kestra/repository/mysql/MysqlExecutionRepositoryService.java","function":"findCondition"},"deprecated":false,"digest":{"function_hash":"57135752952091706183871708149375476211","length":582},"id":"CVE-2026-34612-f8d9fdeb","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"102527382380114762865555654047077750264","length":1446},"id":"CVE-2026-34612-fb673ec1","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3","target":{"file":"jdbc-h2/src/main/java/io/kestra/repository/h2/H2ExecutionRepositoryService.java","function":"findLabelCondition"},"deprecated":false}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}