Skip to content
OpenAdvisories

Vendor

kestra-io

15 known vulnerabilities.

Products

kestra 15
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.7
    CVE-2026-55839

    Kestra: Stored XSS via custom Markdown [[link]] attribute injection

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler at…

    kestra-io kestra io.kestra:kestra Maven
  • High 8.6
    CVE-2026-73247

    Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client…

    kestra-io kestra io.kestra:core io.kestra:kestra-core Maven
  • High 7.5
    CVE-2026-73246

    Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can ex…

    kestra-io kestra
  • High 7.7
    CVE-2026-45807

    Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from th…

    kestra-io kestra
  • High 7.7
    CVE-2026-49984

    Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can there…

    kestra-io kestra
  • High 8.7
    CVE-2026-55069

    Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database…

    kestra-io kestra
  • High 7.3
    CVE-2026-33664

    Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields

    Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Markdown.vue component instantiated with ht…

    kestra-io kestra
  • High 7.3
    CVE-2026-29082

    Kestra: Stored Cross-Site Scripting in Markdown File Preview

    Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanit…

    kestra-io kestra