# CVE-2026-55069: Kestra OSS weak password hashing in BasicAuth component

Source: https://junglewise.ai/threats/cve-2026-55069-kestra-oss-weak-password-hashing-in-basicauth-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-55069 · Severity: high · CVSS 8.7 · Published 2026-06-26

Kestra is an open-source platform used to automate and orchestrate complex business workflows. A security flaw in how the platform stores administrator passwords allows attackers who gain access to the underlying database to quickly crack those passwords using standard hardware. Once an attacker recovers the administrator password, they can take full control of the Kestra platform and, in many cloud environments, gain unauthorized access to sensitive credentials and secrets across the entire server cluster.

Technologies: [Kestra](https://junglewise.ai/threats/technologies/kestra). Vendors: [Kestra](https://junglewise.ai/threats/vendors/kestra).

## Quick answers

**Is CVE-2026-55069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55069 being exploited in the wild.

**How severe is CVE-2026-55069?** High severity, with a CVSS score of 8.7, published 26 June 2026.

**Which products and versions are affected?** Kestra < 1.3.24.

**Is there a fix for CVE-2026-55069?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55069 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-55069?** Check whether you run Kestra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Kestra OSS BasicAuth component uses SHA-512 (via Guava's Hashing.sha512()) to store credentials in the PostgreSQL 'settings' table. Because SHA-512 is a high-speed cryptographic hash rather than a slow Key Derivation Function (KDF) like bcrypt or Argon2id, it lacks a work factor to resist modern GPU-accelerated brute-force attacks. An attacker who obtains the database contents (e.g., via SQL injection, leaked backups, or misconfigured network access) can recover plaintext passwords offline. In Kubernetes environments, this leads to vertical privilege escalation: an attacker can use the recovered admin credentials to create Kestra Flows that execute shell commands, allowing them to steal the pod's ServiceAccount token and access all Kubernetes Secrets within the namespace. The vulnerability is remediated in version 1.3.24 by implementing more secure password hashing.

## Affected products

- Kestra Kestra OSS < 1.3.24

## Timeline

- 2026-03-03: other: Vulnerability verification and PoC execution
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-26: disclosed: NVD publication date

## References

- [https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h](https://github.com/kestra-io/kestra/security/advisories/GHSA-m727-pcjm-j28h)

## Related threats

- [Kestra stored XSS via custom Markdown link attribute injection](https://junglewise.ai/threats/cve-2026-55839-kestra-stored-xss-via-custom-markdown-link-attribute-injection)
- [Kestra Server-Side Request Forgery via Pebble http() function](https://junglewise.ai/threats/cve-2026-73247-kestra-server-side-request-forgery-via-pebble-http-function)
- [Kestra unauthenticated worker endpoint exposes task credentials](https://junglewise.ai/threats/cve-2026-73246-kestra-unauthenticated-worker-endpoint-exposes-task-credentials)
- [Kestra unauthenticated management endpoints on port 8081](https://junglewise.ai/threats/cve-2026-73245-kestra-unauthenticated-management-endpoints-on-port-8081)
- [Kestra access control bypass in previewFileFromExecution endpoint](https://junglewise.ai/threats/cve-2026-53577-kestra-access-control-bypass-in-previewfilefromexecution-endpoint)