CVE-2026-55069CWE-916

Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

High · published June 26, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
14.7
In the wild
Unconfirmed
What it is

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00244 · 14.7th percentile
Weakness
CWE-916 · Use of Password Hash With Insufficient Computational Effort
Published
2026-06-26T20:50Z
EPSS history
Timeline
  • 26 JUN 20:50Z
    Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
    cvelistv5