Critical· 9.8
CVE-2026-38428
CVE-2026-38428 is a critical SQL injection vulnerability in Kestra versions 1.3.3 and earlier. Attackers can exploit user-controlled input to inject malicious SQL queries, leading to high confidentiality, integrity, and availability impacts.
publishedMay 5, 2026
last modifiedJul 24, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
29th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 7, 2026
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
01
Who is affected
Users of Kestra v1.3.3 or earlier
02
Real-world impact
Attackers could execute arbitrary database commands, potentially stealing, modifying, or deleting data.
03
Why this severity
CVSS 9.8 (critical): High risk due to ease of exploitation and severe consequences.
04
What to do about it
no official fix yet
interim mitigations
- ›Avoid using Kestra v1.3.3 or earlier until a patched version is available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in sources
05
Timeline
- May 5, 2026 · May 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- github.com/kestra-io/kestra/security/a…exploitmitigationvendor advisory
- link.comnot applicable
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →