Executive brief
Kestra is an open-source platform used to automate and orchestrate complex business workflows. A security flaw in how the platform stores administrator passwords allows attackers who gain access to the underlying database to quickly crack those passwords using standard hardware. Once an attacker recovers the administrator password, they can take full control of the Kestra platform and, in many cloud environments, gain unauthorized access to sensitive credentials and secrets across the entire server cluster.
Technical details
The Kestra OSS BasicAuth component uses SHA-512 (via Guava's Hashing.sha512()) to store credentials in the PostgreSQL 'settings' table. Because SHA-512 is a high-speed cryptographic hash rather than a slow Key Derivation Function (KDF) like bcrypt or Argon2id, it lacks a work factor to resist modern GPU-accelerated brute-force attacks. An attacker who obtains the database contents (e.g., via SQL injection, leaked backups, or misconfigured network access) can recover plaintext passwords offline. In Kubernetes environments, this leads to vertical privilege escalation: an attacker can use the recovered admin credentials to create Kestra Flows that execute shell commands, allowing them to steal the pod's ServiceAccount token and access all Kubernetes Secrets within the namespace. The vulnerability is remediated in version 1.3.24 by implementing more secure password hashing.
Affected products
- Kestra Kestra OSS < 1.3.24
Timeline
- 2026-03-03: other: Vulnerability verification and PoC execution
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date