Kestra versions 1.3.3 and earlier are vulnerable to SQL Injection because unfiltered user input from a GET parameter is directly concatenated into an SQL query. The missing sanitization allows attackers to inject arbitrary SQL expressions, giving them the ability to read, modify, or delete database contents. The underlying weakness corresponds to an SQL Injection flaw (CWE-89) where user‑supplied data is directly concatenated into a query without proper sanitization, leading to execution of unintended SQL.

The affected product is Kestra, a data workflow orchestration platform. Versions up to and including 1.3.3 are vulnerable; newer releases may contain a fix. No other vendors or products are known to be affected at this time.

Based on the description, the likely attack vector is a standard HTTP GET request to an endpoint that accepts user‑controlled input. Any user able to reach the application can trigger the vulnerability remotely. The vulnerability can allow read, modification, or deletion of database contents, depending on the database privileges used by Kestra. The CVSS score of 9.8 indicates a critical level of severity, and the EPSS score of < 1% suggests a low probability of exploitation, although the lack of mitigation still warrants attention. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and high potential impact recommend swift action.