Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1037

NIXPKGS-2026-1037
published on
Permalink CVE-2026-34612
10.0 CRITICAL
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 17 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 1 week ago
  • @LeSuisse accepted 17 hours ago
  • @LeSuisse published on GitHub 17 hours ago
Kestra: Remote Code Execution via SQL Injection

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

Affected products

kestra
  • ==< 1.3.7

Matching in nixpkgs

pkgs.python312Packages.kestra

Infinitely scalable orchestration and scheduling platform, creating, running, scheduling, and monitoring millions of complex pipelines

pkgs.python313Packages.kestra

Infinitely scalable orchestration and scheduling platform, creating, running, scheduling, and monitoring millions of complex pipelines

pkgs.python314Packages.kestra

Infinitely scalable orchestration and scheduling platform, creating, running, scheduling, and monitoring millions of complex pipelines

Package maintainers