Description
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
Affected products
kestra: kestra
References3
- github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-… ExploitMitigationVendor Advisory
- github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-… ExploitMitigationVendor Advisory
- www.link.com Not Applicable
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 31 · as of 13 November 2026
- CWE
- CWE-89
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.