Kestra <= 1.3.20 - Remote Code Execution

Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Scans Kestra instances for the endsWith"/configs" authentication filter bypass. Kestra's AuthenticationFilter.java checks request.getPath.endsWith"/configs" instead of matching the exact path /api/v1/configs. Since Kestra addresses resources via...

CVE-2026-53576

Kestra Unauthenticated RCE Exploit CVE-2026-53576 Critical Authentication Bypass leading to Unauthenticated Remote Code Execution Exploit • Vulnerability Details • Impact • Remediation ⚠️ DISCLAIMER This tool is for educational and authorized security testing purposes only. DO NOT use this against...

CVE-2026-49869

CVE-2026-49869: Kestra Unauthenticated Remote Code Execution ★PoC and Docker lab for the authentication bypass in Kestra OSS AuthenticationFilter★ Run this lab only on systems you control. The -p 8080:8080 example may publish the vulnerable API on all host interfaces; block access from other...

Vulnerability-lab-cve-2026-53576

this is a reproducible vulnerability lab for the cve-2026-53576 which is a remote code execution in kestra. the whole process has been automated. simply run the bash script for it. refer to the below link for the nuclei template used:...

Kestra-cve-2026-53576

Unauthenticated RCE in Kestra via a Trailing-Path Auth Bypass CVE-2026-53576 Contents Executive Summary 1. Summary 2. Affected / Fixed Versions 3. Test Environment & Pre-Flight Check 4. Root Cause 5. Attack Simulation 6. Detection Engineering 7. ATT&CK Mapping 8. Remediation & Hardening 9...

Kestra 1.3.20 Authentication Bypass / Remote Code Execution

Kestra version 1.3.20 contains an authentication-filter bypass that permits unauthenticated workflow creation and execution through a path ending in /configs, resulting in command execution inside the worker container. https://packetstorm.news/download/237872...

...[ More ]

There is a critical authentication bypass vulnerability residing within Kestra OSS's core request-filtering mechanism. Due to insecure suffix-matching logic instead of strict routing or exact segment validation, attackers can craft custom request paths that bypass security controls. This allows...

Kestra CVE-2026-49869 Auth Bypass Detect

Detects CVE-2026-49869 in Kestra OSS before 1.0.45 / 1.3.21: AuthenticationFilter forwards any /api/v1/ path ending in /configs without Basic Auth. Compares a blocked path with the bypass suffix, then optionally confirms with a benign echo flow create, execute, cleanup. !/usr/bin/env python3 --...

Kestra <= 1.3.20 / 1.0.44 - /configs Auth Bypass RCE (CVE-2026-49869)

Exploits CVE-2026-49869: Micronaut AuthenticationFilter whitelists any path ending in /configs. Unauthenticated PUT creates a shell workflow, POST triggers execution, logs are polled for command output. Fixed in Kestra 1.0.45 and 1.3.21. !/usr/bin/env python3 -- coding: utf-8 -- """Kestra OSS...

Exploit for OS Command Injection in Kestra

CVE-2026-49869: Kestra Unauthenticated Remote Code Execution...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Kestra

Unauthenticated RCE in Kestra via a Trailing-Path Auth Bypass...

CVE-2026-73245

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:08+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

EUVD-2026-57013

Kestra: SSRF via Pebble http function allows unauthenticated access to internal services & cloud metadata...

Kestra configs authentication bypass

Added: 09/04/2026 Background Kestra is open-source software for data, AI, and infrastructure workflows. Problem An authentication bypass vulnerability in the AuthenticationFilter class allows remote unauthenticated attackers to bypass authentication for any request path ending with "configs",...