CVE-2026-38428

The vulnerability results from directly concatenating user input data — passed through the GET request parameter — with the content of the SQL query, without applying proper sanitization or query parameterization. An attacker can craft a malicious GET parameter value that will be interpreted by the database engine as part of the SQL query. As a result, arbitrary modification of the query logic executed by the application is possible.

An attacker can gain unauthorized access to data stored in the database, modify or delete data, and depending on the database configuration — potentially take control of the database server or cause it to become unavailable.

Kestra must be updated to a version newer than 1.3.3. Detailed information about available patches can be found in the official security advisory from the vendor at: https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x

Kestra in version 1.3.3 and all earlier versions.