CVE-2026-38428 describes a critical SQL Injection vulnerability in Kestra v1.3.3 and earlier. The issue arises because user-controlled input from a GET parameter is concatenated directly into an SQL query without proper sanitization or parameterization, enabling attackers to inject arbitrary SQL expressions. This vulnerability is classified under CWE-89 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed, and the product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability can lead to full compromise of the affected Kestra system's database, including unauthorized data disclosure, data modification, and denial of service. The critical CVSS score reflects the ease of exploitation (network attack vector, no privileges or user interaction required) and the severe impact on confidentiality, integrity, and availability. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing temporary mitigations such as input validation, web application firewalls (WAFs) with SQL injection protections, or disabling vulnerable functionality if feasible. Monitor vendor channels closely for updates and patches.