CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

CVE-2026-73245: Missing Authentication for Critical Function

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

io.micronaut.jms:micronaut-jms-activemq-artemis (1.0.0.m2), io.micronaut.jms:micronaut-jms-activemq-classic (1.0.0.m2) +18 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (2.4.3)

io.micronaut:micronaut-context MAVEN version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-context and may be impacted: - io.micronaut.jms:micronaut-jms-activemq-artemis 1.0.0.m2 -...

io.kokuwa.micronaut:micronaut-openapi-codegen (1.5.0), io.micronaut:micronaut-function (2.0.3) +17 more potentially affected by CVE-2022-21700 via io.micronaut:micronaut-http (2.0.3)

io.micronaut:micronaut-http MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http and may be impacted: - io.kokuwa.micronaut:micronaut-openapi-codegen 1.5.0 - io.micronaut:micronaut-function 2.0.3 -...