CVE-2026-55069

HighPublic PoC

Published: 26 June 2026

Published

26 June 2026

Modified

01 July 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS Score 0.0016 5.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-55069 is a high-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability in Kestra Kestra. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-39917

Vulnerability details

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation…

speed to recover the administrator password offline. In Kubernetes deployments, a successful crack further enables reading of the cluster ServiceAccount Token and all K8s Secrets, achieving vertical privilege escalation. This vulnerability is fixed in 1.3.24.

CWE(s): CWE-916

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1110.002 Password Cracking Credential Access

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct offline password cracking via weak SHA-512 hash (T1110.002) from DB read access; enables vertical privilege escalation via recovered admin credentials and K8s secrets/tokens (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0