Kestra <= 1.3.20 - Remote Code Execution

Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...

CVE-2026-49869

CVE-2026-49869: Неаутентифицированное удалённое выполнение кода в Kestra ★PoC и Docker-лаборатория для обхода аутентификации в AuthenticationFilter Kestra OSS★ Запускайте эту лабораторию только на системах, которые вы контролируете. Пример с -p 8080:8080 может опубликовать уязвимый API на всех...

CVE-2026-49869

Scanneur Kestra CVE-2026-49869 / CVE-2026-53576 Scanne les instances Kestra pour le contournement du filtre d'authentification endsWith"/configs". Le AuthenticationFilter.java de Kestra vérifie request.getPath.endsWith"/configs" au lieu de correspondre au chemin exact /api/v1/configs. Comme Kestr...

Exploit for OS Command Injection in Kestra

CVE-2026-49869: Kestra Unauthenticated Remote Code Execution...

Kestra-cve-2026-53576

Неаутентифицированное RCE в Kestra через обход аутентификации с помощью завершающего пути CVE-2026-53576 Содержание Краткое резюме 1. Сводка 2. Уязвимые / исправленные версии 3. Тестовая среда и предполётная проверка 4. Первопричина 5. Симуляция атаки 6. Инженерия обнаружения 7...

CVE-2026-53576

Эксплойт неавторизованного RCE в Kestra CVE-2026-53576 Критический обход аутентификации, ведущий к неавторизованному удалённому выполнению кода Эксплойт • Детали уязвимости • Воздействие • Устранение ⚠️ ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ Этот инструмент предназначен только для образовательных целей и...

CVE-2026-73245

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:08+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

GHSA-R56G-Q4P6-M3P6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Summary The Pebble template engine's http function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery SSRF attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoint...

EUVD-2026-57013

Kestra: SSRF via Pebble http function allows unauthenticated access to internal services & cloud metadata...

Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...

VulnCheck KEV: CVE-2026-49869

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials...

Stored Cross-Site Scripting (XSS)

Kestra is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of JavaScript event-handler attributes in the custom link Markdown syntax, which allows an attacker with permission to create or update a Flow description to inject malicious JavaScript that...

CVE-2026-55839

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:18+00:00| published-proof-of-concept| https://github.com/kestra-io/kestra/security/advisories/GHSA-34pm-923j-7wf8...

GHSA-34PM-923J-7WF8 Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Summary Kestra’s Markdown renderer supports a custom link ... syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can...

CVE-2026-55839

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...