CVE-2026-38428: SQL Injection
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38428?
CVE-2026-38428 is classified as a high severity vulnerability due to its potential to allow attackers to execute arbitrary SQL queries.
How do I fix CVE-2026-38428?
To fix CVE-2026-38428, upgrade to Kestra version 1.3.4 or later, which includes proper input sanitization and parameterization.
What software versions are affected by CVE-2026-38428?
CVE-2026-38428 affects Kestra versions 1.3.3 and earlier.
Can CVE-2026-38428 lead to data breaches?
Yes, CVE-2026-38428 can lead to data breaches by allowing attackers to execute unauthorized SQL commands that expose sensitive data.
Is CVE-2026-38428 an input validation vulnerability?
Yes, CVE-2026-38428 is an input validation vulnerability that arises from improper handling of user-controlled input in SQL queries.