The vulnerability arises because Kestra stores BasicAuth passwords using unsalted SHA‑512, a attackers who can read the PostgreSQL database to perform offline brute‑force attacks. Recovering the administrator password gives attackers full control of the orchestration platform, and in Kubernetes environments can further enable reading of ServiceAccount tokens and all cluster secrets, effectively escalating privileges.

The issue affects Kestra (kestra‑io) open‑source workflow orchestration platform versions prior to 1.3.24, where the BasicAuth component stores passwords as SHA‑512. The fix is delivered in Kestra 1.3.24 and later releases.

The CVSS score is 8.7, indicating high risk, and no EPSS data is available; the vulnerability is not listed in the CISA KEV catalog. The attack requires read access to the PostgreSQL database, which may result from compromised services or misconfigured permissions. Once the password is cracked, the attacker can hijack administrative functions and, in Kubernetes deployments, obtain ServiceAccount tokens and all secrets, leading to vertical privilege escalation.