Skip to content
OpenAdvisories

Vendor

kestra-io

15 known vulnerabilities.

Products

kestra 15
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-73245

    Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080,…

    kestra-io kestra io.kestra:kestra Maven
  • Medium 6.5
    CVE-2026-53577

    Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user …

    kestra-io kestra
  • Medium 6.5
    CVE-2026-48129

    Kestra task inputFiles accepts traversal filenames for worker file writes

    Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, Kestra task `inputFiles` writes rendered file names directly under the task working directory. When a flow forwards untrusted execution or web…

    kestra-io kestra
  • Medium 4.2
    CVE-2025-53543

    Kestra allows Stored XSS before 0.22

    Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

    kestra-io kestra