Skip to contentKestra-io Kestra vulnerabilities
- kestra-io kestraKestra: Stored XSS via custom Markdown [[link]] attribute injectionCVE-2026-55839Fix available8.7 High
- kestra-io kestraKestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadataCVE-2026-73247Fix available8.6 High
- kestra-io kestraKestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentialsCVE-2026-732467.5 High
- kestra-io kestraKestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-authCVE-2026-73245Fix available6.5 Medium
- kestra, kestra oss +1 moreKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`CVE-2026-49869In KEVPublic exploit10.0 Critical
- kestraKestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file readCVE-2026-458077.7 High
- kestraKestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)CVE-2026-499847.7 High
- kestraKestra: Unauthenticated RCE via /configs path-suffix auth-filter bypassCVE-2026-53576Public exploit10.0 Critical
- kestraKestra: Cross-Execution File Read via Preview Endpoint (IDOR)CVE-2026-535776.5 Medium
- kestraKestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force AttackCVE-2026-550698.7 High
- kestra-io kestraKestra task inputFiles accepts traversal filenames for worker file writesCVE-2026-481296.5 Medium
- kestraKestra: Remote Code Execution via SQL InjectionCVE-2026-3461210.0 Critical
- kestraKestra Vulnerable to Stored Cross-Site Scripting via Flow YAML FieldsCVE-2026-336647.3 High
- kestraKestra: Stored Cross-Site Scripting in Markdown File PreviewCVE-2026-290827.3 High
- kestra-io kestraKestra allows Stored XSS before 0.22CVE-2025-535434.2 Medium