CVE-2026-55069: Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kestra OSS workflow orchestration platform (BasicAuth authentication component)to a version that resolves this vulnerability.Fixed in 1.3.24 - Operational
After upgrading to Kestra 1.3.24, rotate the Kestra BasicAuth administrator password because it may have been recovered via offline brute-force from SHA-512 hashes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55069?
The severity of CVE-2026-55069 is high with a CVSS score of 8.7.
What is the impact of CVE-2026-55069?
CVE-2026-55069 allows an attacker with read access to the PostgreSQL database to perform an offline brute-force attack on BasicAuth passwords.
How can I fix CVE-2026-55069?
To fix CVE-2026-55069, upgrade to Kestra version 1.3.24 or later.
Who is affected by CVE-2026-55069?
Any user of the Kestra OSS workflow orchestration platform prior to version 1.3.24 is affected by CVE-2026-55069.
What vulnerability does CVE-2026-55069 describe?
CVE-2026-55069 describes a vulnerability in the BasicAuth authentication component that stores passwords using SHA-512, which can be exploited for offline brute-force attacks.