kestra-io vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202614

Known exploitedNewest addition to KEV first

• CVE-2026-49869

  Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

  kestra-io · kestra

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-55839

  Kestra: Stored XSS via custom Markdown [[link]] attribute injection

  kestra-io · kestra

  High8.7
• CVE-2026-73247

  Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

  kestra-io · kestra

  High8.6
• CVE-2026-73246

  Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

  kestra-io · kestra

  High7.5
• CVE-2026-73245

  Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

  kestra-io · kestra

  Medium6.5
• CVE-2026-49869

  Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

  kestra-io · kestra

  ExploitedCritical10.0
• CVE-2026-45807

  Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read

  kestra-io · kestra

  High7.7
• CVE-2026-49984

  Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

  kestra-io · kestra

  High7.7
• CVE-2026-53576

  Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

  kestra-io · kestra

  Critical10.0
• CVE-2026-53577

  Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)

  kestra-io · kestra

  Medium6.5
• CVE-2026-55069

  Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

  kestra-io · kestra

  High8.7