Kestra-io vulnerabilities

Products

• Kestra 15

Newest

• kestra-io kestra Kestra: Stored XSS via custom Markdown [[link]] attribute injection CVE-2026-55839 Fix available 8.7 HighAugust 18, 2026
• kestra-io kestra Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata CVE-2026-73247 Fix available 8.6 HighAugust 11, 2026
• kestra-io kestra Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials CVE-2026-73246 7.5 HighAugust 11, 2026
• kestra-io kestra Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth CVE-2026-73245 Fix available 6.5 MediumAugust 11, 2026
• kestra, kestra oss +1 more Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` CVE-2026-49869 In KEVPublic exploit 10.0 CriticalJune 26, 2026
• kestra Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read CVE-2026-45807 7.7 HighJune 26, 2026
• kestra Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard) CVE-2026-49984 7.7 HighJune 26, 2026
• kestra Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass CVE-2026-53576 Public exploit 10.0 CriticalJune 26, 2026
• kestra Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) CVE-2026-53577 6.5 MediumJune 26, 2026
• kestra Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack CVE-2026-55069 8.7 HighJune 26, 2026
• kestra-io kestra Kestra task inputFiles accepts traversal filenames for worker file writes CVE-2026-48129 6.5 MediumJune 19, 2026
• kestra Kestra: Remote Code Execution via SQL Injection CVE-2026-34612 10.0 CriticalApril 3, 2026
• kestra Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields CVE-2026-33664 7.3 HighMarch 26, 2026
• kestra Kestra: Stored Cross-Site Scripting in Markdown File Preview CVE-2026-29082 7.3 HighMarch 6, 2026
• kestra-io kestra Kestra allows Stored XSS before 0.22 CVE-2025-53543 4.2 MediumJuly 7, 2025