Vulnerabilities

TI-2026-36769 CVE-2026-49869

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

CRITICAL 100KEV

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02095 Published 2026-06-26 Fixed in 1.0.45, 1.3.21 CWE-184

TI-2026-33542 CVE-2026-45807

Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read

HIGH 67

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00567 Published 2026-06-26 Fixed in 1.0.43, 1.3.19 CWE-22

TI-2026-36817 CVE-2026-49984

Information disclosure in kestra

HIGH 67

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00567 Published 2026-06-26 Fixed in 1.0.45, 1.3.23 CWE-180

TI-2026-38637 CVE-2026-53576

Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

HIGH 82

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.03296 Published 2026-06-26 Fixed in 1.0.45, 1.3.21 CWE-288

TI-2026-38638 CVE-2026-53577

Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)

MEDIUM 62

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00437 Published 2026-06-26 Fixed in 1.0.45, 1.3.21 CWE-863

TI-2026-39775 CVE-2026-55069

Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack

HIGH 73

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00244 Published 2026-06-26 Fixed in 1.3.24 CWE-916

TI-2026-28138 CVE-2026-38428 · GHSA-9jrq-5wf3-m9fp

Kestra v1.3.3 and before is vulnerable to SQL Injection.

HIGH 82

Kestra v1.3.3 and before is vulnerable to SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00367 Published 2026-05-05 No fix listed CWE-89

TI-2026-26858 CVE-2026-34612

Kestra: Remote Code Execution via SQL Injection

HIGH 76

Kestra is an open-source, event-driven orchestration platform.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00681 Published 2026-04-03 Fixed in 1.3.7 CWE-89

TI-2026-26044 CVE-2026-33664

Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields

HIGH 67

Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Mark…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00265 Published 2026-03-26 No fix listed CWE-79

TI-2026-23227 CVE-2026-29082

Kestra: Stored Cross-Site Scripting in Markdown File Preview

HIGH 67

Kestra is an event-driven orchestration platform.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00271 Published 2026-03-06 No fix listed CWE-79

Vulnerabilities

Filters