165 matches found
CVE-2026-53576
Kestra Unauthenticated RCE Exploit CVE-2026-53576 Critical Authentication Bypass leading to Unauthenticated Remote Code Execution Exploit • Vulnerability Details • Impact • Remediation ⚠️ DISCLAIMER This tool is for educational and authorized security testing purposes only. DO NOT use this against...
Kestra <= 1.3.20 - Remote Code Execution
Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...
CVE-2026-49869
CVE-2026-49869: Kestra Unauthenticated Remote Code Execution ★PoC and Docker lab for the authentication bypass in Kestra OSS AuthenticationFilter★ Run this lab only on systems you control. The -p 8080:8080 example may publish the vulnerable API on all host interfaces; block access from other...
CVE-2026-49869
Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Scans Kestra instances for the endsWith"/configs" authentication filter bypass. Kestra's AuthenticationFilter.java checks request.getPath.endsWith"/configs" instead of matching the exact path /api/v1/configs. Since Kestra addresses resources via...
Exploit for OS Command Injection in Kestra
CVE-2026-49869: Kestra Unauthenticated Remote Code Execution...
Kestra-cve-2026-53576
Unauthenticated RCE in Kestra via a Trailing-Path Auth Bypass CVE-2026-53576 Contents Executive Summary 1. Summary 2. Affected / Fixed Versions 3. Test Environment & Pre-Flight Check 4. Root Cause 5. Attack Simulation 6. Detection Engineering 7. ATT&CK Mapping 8. Remediation & Hardening 9...
CVE-2026-73245
creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:08+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7...
EUVD-2026-57010
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...
GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...
GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...
EUVD-2026-57013
Kestra: SSRF via Pebble http function allows unauthenticated access to internal services & cloud metadata...
Kestra OSS OS Command Injection Vulnerability
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...
VulnCheck KEV: CVE-2026-49869
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...
Stored Cross-Site Scripting (XSS)
Kestra is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of JavaScript event-handler attributes in the custom link Markdown syntax, which allows an attacker with permission to create or update a Flow description to inject malicious JavaScript that...
CVE-2026-55839
creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:18+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-34pm-923j-7wf8...
GHSA-34PM-923J-7WF8 Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...
CVE-2026-55839
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...