Kestra versions 1.3.3 and earlier are vulnerable to SQL Injection because unfiltered user input from a GET parameter is directly concatenated into an SQL query. The missing sanitization allows attackers to inject arbitrary SQL expressions, giving them the ability to read, modify, or delete database contents. The underlying weakness corresponds to an input validation error where user‑supplied data is not properly sanitized, leading to the execution of unintended SQL.

The affected product is Kestra, a data workflow orchestration platform. Versions up to and including 1.3.3 are vulnerable; newer releases may contain a fix. No other vendors or products are known to be affected at this time.

Based on the description, it is inferred that the attack vector is a standard HTTP GET request to an endpoint that accepts user-controlled input. This means any user who can reach the application endpoint can trigger the vulnerability remotely. The vulnerability can lead from data disclosure to full database compromise, depending on the database privileges used by Kestra. The EPSS score is not available, but the lack of mitigation makes the potential for exploitation high. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and high impact warrant prompt attention.