CVE-2026-34612

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

• CWE-89

• https://github.com/kestra-io/kestra/commit/3926762795df8ad3e03924b370c51832ed3a21d3Patch
• https://github.com/kestra-io/kestra/releases/tag/v1.3.7Product, Release Notes
• https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9xExploit, Mitigation, Vendor Advisory
• https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9xExploit, Mitigation, Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34606Frappe Learning Management System (LMS) is a learning system…6.1
• CVE-2026-34607Emlog is an open source website building system. In versions…7.2
• CVE-2026-34608NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …8.2
• CVE-2026-3461The Visa Acceptance Solutions plugin for WordPress is vulner…9.8
• CVE-2026-34610The leancrypto library is a cryptographic library that exclu…5.9
• CVE-2026-34611WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34613WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34614Adobe Connect versions 2025.3, 12.10 and earlier are affecte…6.1
• CVE-2026-34615Adobe Connect versions 2025.3, 12.10 and earlier are affecte…9.3
• CVE-2026-34617Adobe Connect versions 2025.3, 12.10 and earlier are affecte…8.7
• CVE-2026-34618Illustrator versions 30.2, 29.8.5 and earlier are affected b…7.8
• CVE-2026-34619ColdFusion versions 2023.18, 2025.6 and earlier are affected…7.7