kestra-io kestra
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-55839 | < 1.3.24 | Kestra: Stored XSS via custom Markdown [[link]] attribute injection | HIGH 8.7 | 0.4 % | ||
| CVE-2026-73247 | < 2.0.0 | Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata | HIGH 8.6 | 0.4 % | ||
| CVE-2026-73246 | < 1.3.31 | Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials | HIGH 7.5 | 0.6 % | ||
| CVE-2026-73245 | < 2.0.0-rc6 | Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-49869 | < 1.0.45 ; >= 1.1.0, < 1.3.21 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` | CRITICAL 10.0 | 2.1 % | KEV | |
| CVE-2026-45807 | < 1.0.43 ; >= 1.1.0, < 1.3.19 | Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read | HIGH 7.7 | 0.6 % | ||
| CVE-2026-49984 | < 1.0.45 ; >= 1.1.0, < 1.3.23 | Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API… | HIGH 7.7 | 0.6 % | ||
| CVE-2026-53576 | < 1.0.45 ; >= 1.1.0, < 1.3.21 | Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass | CRITICAL 10.0 | 3.3 % | ||
| CVE-2026-53577 | < 1.0.45 ; >= 1.1.0, < 1.3.21 | Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-55069 | < 1.3.24 | Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack | HIGH 8.7 | 0.2 % | ||
| CVE-2026-48129 | < 1.0.43 ; >= 1.1.0, < 1.1.19 ; >= 1.2.0, < 1.2.19 ; … | Kestra task inputFiles accepts traversal filenames for worker file writes | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-34612 | < 1.3.7 | Kestra: Remote Code Execution via SQL Injection | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-33664 | <= 1.3.3 | Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields | HIGH 7.3 | 0.3 % | ||
| CVE-2026-29082 | <= 1.1.10 | Kestra: Stored Cross-Site Scripting in Markdown File Preview | HIGH 7.3 | 0.2 % | ||
| CVE-2025-53543 | < 0.22.0 | Kestra allows Stored XSS before 0.22 | MEDIUM 4.2 | 0.2 % |