Kestra: fast SHA-512 admin password hash allows offline cracking and cluster token theft

Impact

Kestra is an event-driven orchestrator used to drive pipeline and batch work. It stores the BasicAuth administrator password as a plain fast SHA-512 digest, so anyone who gets read access to the backing PostgreSQL database can recover the admin password offline at high throughput. With the admin account, a Kubernetes-hosted Kestra becomes a path to the cluster ServiceAccount token and every Secret it can read - which on a fleet running orchestrated training jobs typically means registry credentials, object-store keys and the ability to schedule arbitrary workloads on GPU nodes. The flaw needs a prior database read, so it is an escalation primitive rather than an entry point.

Who can reach it

Anyone with read access to Kestra's PostgreSQL database (a database credential, a backup, a replica, or an SQL-injection foothold elsewhere). Cracking is offline and unauthenticated against Kestra itself.

What to do

Upgrade Kestra to 1.3.24 and restart the service. Rotate the administrator password after upgrading, since the old hash may already be in an attacker's hands, and rotate the Kestra ServiceAccount token and any Secrets it could read if database exposure is suspected. Daemon restart only; no node maintenance.

References

Related entries

• Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME201C (through 8.4.18, LINX-A64): An out-of-boundsCVE-2026-55732 · Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD and LIP-ME201C (through 8.4.18, LINX-A64)High
• Netty: OpenSSL client path silently skips TLS hostname verification on Java 25+CVE-2026-62243 · Netty io.netty:netty-handler (SslProvider.OPENSSL client-side hostname verification)High
• Pure Storage FlashArray Purity (data path information exposure): Insufficient filtering on certain data paths exposesCVE-2026-6445 · Pure Storage FlashArray Purity (data path information exposure)High
• SeaweedFS S3 API: raw OIDC JWT bypasses IAM role trust policy and grants that role's bucket accessCVE-2026-77298 · SeaweedFS S3 API (direct OIDC bearer token to IAM role mapping)High
• OpenNebula: one.vm.exec skips the permission check, letting any user run commands in other tenants' VMsCVE-2026-84165 · OpenNebula (one.vm.exec API authorization)High
• Ansible automation-controller: ANSI OSC 8 sequences in job output become clickable javascript: linksCVE-2026-84683 · Red Hat Ansible Automation Platform automation-controller (job stdout HTML view, ANSI OSC 8 handling)High