Kestra vulnerabilities

Products

• Kestra 10

Newest

• kestra, kestra oss +1 more Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` CVE-2026-49869 In KEVPublic exploit 10.0 CriticalJune 26, 2026
• kestra Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read CVE-2026-45807 7.7 HighJune 26, 2026
• kestra Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard) CVE-2026-49984 7.7 HighJune 26, 2026
• kestra Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass CVE-2026-53576 Public exploit 10.0 CriticalJune 26, 2026
• kestra Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) CVE-2026-53577 6.5 MediumJune 26, 2026
• kestra Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack CVE-2026-55069 8.7 HighJune 26, 2026
• kestra Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user... CVE-2026-38428 9.8 CriticalApril 3, 2026
• kestra Kestra: Remote Code Execution via SQL Injection CVE-2026-34612 10.0 CriticalApril 3, 2026
• kestra Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields CVE-2026-33664 7.3 HighMarch 26, 2026
• kestra Kestra: Stored Cross-Site Scripting in Markdown File Preview CVE-2026-29082 7.3 HighMarch 6, 2026