Kkestra-io

Products

Exploited and recent CVEs

• CVE-2026-49869 Critical 10.0 Exploited Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` 2.1%
• CVE-2026-55839 High 8.7 Kestra: Stored XSS via custom Markdown [[link]] attribute injection 0.4%
• CVE-2026-73247 High 8.6 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata 0.4%
• CVE-2026-73246 High 7.5 Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials 0.6%
• CVE-2026-73245 Medium 6.5 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth 0.3%
• CVE-2026-45807 High 7.7 Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read 0.6%
• CVE-2026-49984 High 7.7 Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard) 0.6%
• CVE-2026-53576 Critical 10.0 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass 3.3%
• CVE-2026-53577 Medium 6.5 Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) 0.4%
• CVE-2026-55069 High 8.7 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack 0.2%
• CVE-2026-48129 Medium 6.5 Kestra task inputFiles accepts traversal filenames for worker file writes 0.4%
• CVE-2026-34612 Critical 10.0 Kestra: Remote Code Execution via SQL Injection 0.7%
• CVE-2026-33664 High 7.3 Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields 0.3%
• CVE-2026-29082 High 7.3 Kestra: Stored Cross-Site Scripting in Markdown File Preview 0.3%
• CVE-2025-53543 Medium 4.2 Kestra allows Stored XSS before 0.22 0.2%