Skip to content
OpenAdvisories

Vendor

kestra-io

15 known vulnerabilities.

Products

kestra 15
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-49869 Exploited Public exploit

    Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a su…

    kestra-io kestra
    KEV Sep 2, 2026
  • Critical 10.0
    CVE-2026-53576 Public exploit Scanner template

    Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it…

    kestra-io kestra