Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73245Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Medium 6.5

In plain English

A medium-severity missing authentication in kestra from kestra-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.kestra:kestra	2.0.0	GHSA-hpj9-grjp-7vc7

Affected products (as reported)

Vendor	Product	Versions
kestra-io	kestra	< 2.0.0-rc6

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7 x_refsource_CONFIRM