CVE-2026-55069

Katalog CVE

CVSS 8.7 · High EPSS 0,24%

Kerentanan Use of Password Hash With Insufficient Computational Effort pada kestra. Skor CVSS 3.1 8.7 (High) menurut github.com.

Deskripsi (NVD)

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

Rincian

Terbit di NVD

26 Juni 2026

Terakhir diubah

1 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h exploit · mitigasi · advisory vendor