Kestra

Records16All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Kestra records in CISA KEV

TI-2026-36769 Kestra OSS OS Command Injection Vulnerability CRITICAL 100KEV 2026-09-02

Components

Products in the NVD configurations · select one to filter the records

Kestra 10 records CRITICAL

Records

16 records

TI-2026-36769 CVE-2026-49869

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

CRITICAL 100KEV

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02095 Published 2026-06-26 Fixed in 1.0.45, 1.3.21 CWE-184

TI-2026-38637 CVE-2026-53576

Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

HIGH 82

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.03296 Published 2026-06-26 Fixed in 1.0.45, 1.3.21 CWE-288

TI-2026-28138 CVE-2026-38428 · GHSA-9jrq-5wf3-m9fp

Kestra v1.3.3 and before is vulnerable to SQL Injection.

HIGH 82

Kestra v1.3.3 and before is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00367 Published 2026-05-05 No fix listed CWE-89

TI-2026-51384 CVE-2026-73247 · GHSA-r56g-q4p6-m3p6

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

HIGH 76

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00406 Published 2026-08-11 Fixed in 2.0.0 CWE-918

TI-2026-26858 CVE-2026-34612

Kestra: Remote Code Execution via SQL Injection

HIGH 76

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00681 Published 2026-04-03 Fixed in 1.3.7 CWE-89

TI-2026-39775 CVE-2026-55069

Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

HIGH 73

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00244 Published 2026-06-26 Fixed in 1.3.24 CWE-916

TI-2026-51383 CVE-2026-73246

Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

HIGH 72

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00597 Published 2026-08-11 Fixed in 1.3.31 CWE-200

TI-2026-51382 CVE-2026-73245 · GHSA-hpj9-grjp-7vc7

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

HIGH 68

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00328 Published 2026-08-11 Fixed in 2.0.0-rc6, 2.0.0 CWE-306

TI-2026-36817 CVE-2026-49984

Information disclosure in kestra

HIGH 67

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00567 Published 2026-06-26 Fixed in 1.0.45, 1.3.23 CWE-180

TI-2026-33542 CVE-2026-45807

Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read

HIGH 67

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00567 Published 2026-06-26 Fixed in 1.0.43, 1.3.19 CWE-22

TI-2026-26044 CVE-2026-33664

Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields

HIGH 67

Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Mark…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00265 Published 2026-03-26 No fix listed CWE-79

TI-2026-23227 CVE-2026-29082

Kestra: Stored Cross-Site Scripting in Markdown File Preview

HIGH 67

Kestra is an event-driven orchestration platform.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00271 Published 2026-03-06 No fix listed CWE-79

TI-2026-38638 CVE-2026-53577

Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)

MEDIUM 62

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00437 Published 2026-06-26 Fixed in 1.0.45, 1.3.21 CWE-863

TI-2026-35567 CVE-2026-48129

Kestra task inputFiles accepts traversal filenames for worker file writes

MEDIUM 62

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00363 Published 2026-06-19 Fixed in 1.0.43, 1.1.19 +2 CWE-22

TI-2025-33487 CVE-2025-53543

Kestra allows Stored XSS before 0.22

MEDIUM 53

Kestra is an event-driven orchestration platform.

CVSS 3.1MEDIUM 4.2 Local High privileges User interaction EPSS 0.00179 Published 2025-07-07 Fixed in 0.22.0 CWE-79

TI-2026-40304 CVE-2026-55839 · GHSA-34pm-923j-7wf8

Kestra: Stored XSS via custom Markdown [[link]] attribute injection

MEDIUM 40

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.0043 Published 2026-08-18 Fixed in 1.3.24 CWE-79

Open these records in search →

Critical	4
High	8
Medium	4
Low	0
No CVSS	0