CVE-2026-73246

creationtimestamp| type| source ---|---|--- 2026-08-12 00:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mstt5cuqcw2w...

CVE-2026-73246 Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...