Login Request a demo
KE
Product
Kestra
by Kestra · last CVE Jun 26, 2026
On CISA KEVExploited in the wild
10
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities10In the news2Timeline
Severity mix
Critical 4High 3Medium 3Low 0
Severity
All severities10Critical4High3Medium3Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Kestra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55069
8.7
0%
Jun 26
Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Affected: before 1.3.24
CVE-2026-45807
7.7
1%
Jun 26
Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
Affected: before 1.0.43; 1.1.0 before 1.3.19
CVE-2026-49984
7.7
1%
Jun 26
Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
Affected: before 1.0.45; 1.1.0 before 1.3.23
Showing 3