CVE-2026-49869

CVE-2026-49869: Kestra Unauthenticated Remote Code Execution ★PoC and Docker lab for the authentication bypass in Kestra OSS AuthenticationFilter★ Run this lab only on systems you control. The -p 8080:8080 example may publish the vulnerable API on all host interfaces; block access from other...

Kestra-cve-2026-53576

Unauthenticated RCE in Kestra via a Trailing-Path Auth Bypass CVE-2026-53576 Contents Executive Summary 1. Summary 2. Affected / Fixed Versions 3. Test Environment & Pre-Flight Check 4. Root Cause 5. Attack Simulation 6. Detection Engineering 7. ATT&CK Mapping 8. Remediation & Hardening 9...

Kestra <= 1.3.20 - Remote Code Execution

Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Scans Kestra instances for the endsWith"/configs" authentication filter bypass. Kestra's AuthenticationFilter.java checks request.getPath.endsWith"/configs" instead of matching the exact path /api/v1/configs. Since Kestra addresses resources via...

CVE-2026-53576

Kestra Unauthenticated RCE Exploit CVE-2026-53576 Critical Authentication Bypass leading to Unauthenticated Remote Code Execution Exploit • Vulnerability Details • Impact • Remediation ⚠️ DISCLAIMER This tool is for educational and authorized security testing purposes only. DO NOT use this against...

...[ More ]

There is a critical authentication bypass vulnerability residing within Kestra OSS's core request-filtering mechanism. Due to insecure suffix-matching logic instead of strict routing or exact segment validation, attackers can craft custom request paths that bypass security controls. This allows...

Exploit for OS Command Injection in Kestra

CVE-2026-49869: Kestra Unauthenticated Remote Code Execution...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Kestra

Unauthenticated RCE in Kestra via a Trailing-Path Auth Bypass...

CVE-2026-73245

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:08+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

io.kestra:jdbc (0.14.2), io.kestra:repository-memory (0.14.2) +2 more potentially affected by CVE-2026-73247 via io.kestra:core (0.14.2)

io.kestra:core MAVEN version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.kestra:core and may be impacted: - io.kestra:jdbc 0.14.2 - io.kestra:repository-memory 0.14.2 - io.kestra:runner-memory 0.14.2 - io.kestra:storage-local 0.14.2 Sourc...

io.kestra:repository-memory (0.3.0), io.kestra:runner-memory (0.3.0) +1 more potentially affected by CVE-2026-73247 via io.kestra:core (0.3.0)

io.kestra:core MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.kestra:core and may be impacted: - io.kestra:repository-memory 0.3.0 - io.kestra:runner-memory 0.3.0 - io.kestra:storage-local 0.3.0 Source cves: CVE-2026-73247 Sourc...

io.kestra:jdbc (0.15.26), io.kestra:repository-memory (0.15.26) +2 more potentially affected by CVE-2026-73247 via io.kestra:core (0.15.26)

io.kestra:core MAVEN version 0.15.26 is affected by a known vulnerability. The following packages have a transitive dependency on io.kestra:core and may be impacted: - io.kestra:jdbc 0.15.26 - io.kestra:repository-memory 0.15.26 - io.kestra:runner-memory 0.15.26 - io.kestra:storage-local 0.15.26...

io.kestra:jdbc (0.17.2), io.kestra:repository-memory (0.17.2) +3 more potentially affected by CVE-2026-73247 via io.kestra:core (0.17.2)

io.kestra:core MAVEN version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.kestra:core and may be impacted: - io.kestra:jdbc 0.17.2 - io.kestra:repository-memory 0.17.2 - io.kestra:runner-memory 0.17.2 - io.kestra:script 0.17.2 -...

io.kestra:repository-memory (0.2.14), io.kestra:runner-memory (0.2.14) +1 more potentially affected by CVE-2026-73247 via io.kestra:core (0.2.14)

io.kestra:core MAVEN version 0.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on io.kestra:core and may be impacted: - io.kestra:repository-memory 0.2.14 - io.kestra:runner-memory 0.2.14 - io.kestra:storage-local 0.2.14 Source cves: CVE-2026-73247...

EUVD-2026-57013

Kestra: SSRF via Pebble http function allows unauthenticated access to internal services & cloud metadata...

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...