CVE-2026-55069

HighCVSS 8.7/10Last modified Jul 1, 2026

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-916

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2026
Last modified: Jul 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-55074.0When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker CVE-2026-550718.4MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_in CVE-2026-550728.5Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can su CVE-2026-550736.2WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher an CVE-2026-550748.2Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec conn CVE-2026-550757.4Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-550767.4Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-550777.2Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-550786.5Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29 CVE-2026-550796.5Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29 CVE-2026-55086.4The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, CVE-2026-550817.3DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoin