Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73246Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

High 7.5

In plain English

A high-severity information exposure in kestra from kestra-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

Affected products (as reported)

Vendor	Product	Versions
kestra-io	kestra	< 1.3.31

Weakness: CWE-200, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46 x_refsource_CONFIRM