Kestra <= 1.3.20 - Remote Code Execution

Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...

CVE-2026-49869

CVE-2026-49869: Kestra 未认证远程代码执行 ★Kestra OSS AuthenticationFilter 认证绕过漏洞的 PoC 与 Docker 实验环境★ 仅在您控制的系统上运行此实验环境。-p 8080:8080 示例可能会将所有主机接口上的易受攻击 API 暴露出来；请阻止来自其他网络的访问。 https://github.com/user-attachments/assets/e8dc29f2-1fd2-49bb-9a61-3ae67ee69865 概述 Kestra 使用 Basic Auth 保护其 API。在受影响的 OSS...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Scans Kestra instances for the endsWith"/configs" authentication filter bypass. Kestra's AuthenticationFilter.java checks request.getPath.endsWith"/configs" instead of matching the exact path /api/v1/configs. Since Kestra addresses resources via...

Exploit for OS Command Injection in Kestra

CVE-2026-49869: Kestra Unauthenticated Remote Code Execution...

Kestra-cve-2026-53576

Kestra 中通过尾部路径认证绕过实现的未认证 RCE（CVE-2026-53576） 目录 执行摘要 1. 概述 2. 受影响 / 已修复版本 3. 测试环境与预检 4. 根本原因 5. 攻击模拟 6. 检测工程 7. ATT&CK 映射 8. 修复与加固 9. 参考资料 执行摘要 Kestra 是一个开源工作流编排平台，其发布的认证过滤器通过检查 URL 是否 以 /configs 结尾 来判断请求是否需要凭据——这一检查本意是暴露一个无害的公共端点。 由于该检查只查看字符串的尾部，任何 URL...

CVE-2026-53576

Kestra Unauthenticated RCE Exploit CVE-2026-53576 Critical Authentication Bypass leading to Unauthenticated Remote Code Execution Exploit • Vulnerability Details • Impact • Remediation ⚠️ DISCLAIMER This tool is for educational and authorized security testing purposes only. DO NOT use this against...

CVE-2026-73245

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:08+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

EUVD-2026-57013

Kestra: SSRF via Pebble http function allows unauthenticated access to internal services & cloud metadata...

Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...

VulnCheck KEV: CVE-2026-49869

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...

Stored Cross-Site Scripting (XSS)

Kestra is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of JavaScript event-handler attributes in the custom link Markdown syntax, which allows an attacker with permission to create or update a Flow description to inject malicious JavaScript that...

CVE-2026-55839

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:18+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-34pm-923j-7wf8...

GHSA-34PM-923J-7WF8 Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...

CVE-2026-55839

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...