Login Request a demo
KE
Product
kestra
by kestra-io · last CVE Aug 18, 2026
On CISA KEVExploited in the wild
12
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities12In the news2Timeline
Severity mix
Critical 3High 6Medium 3Low 0
Severity
All severities12Critical3High6Medium3Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add kestra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49869
In wildKEV
10.0
2%
Jun 26
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
Affected: < 1.0.45; >= 1.1.0, < 1.3.21
CVE-2026-53576
10.0
3%
Jun 26
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
Affected: < 1.0.45; >= 1.1.0, < 1.3.21
CVE-2026-34612
9.0
1%
Apr 3
Kestra: Remote Code Execution via SQL Injection
Affected: < 1.3.7
CVE-2026-55839
8.7
0%
Aug 18
Kestra: Stored XSS via custom Markdown [[link]] attribute injection
Affected: < 1.3.24
CVE-2026-55069
8.7
0%
Jun 26
Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Affected: < 1.3.24
CVE-2026-73247
8.6
0%
Aug 11
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Affected: < 2.0.0
CVE-2026-45807
7.7
1%
Jun 26
Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
Affected: < 1.0.43; >= 1.1.0, < 1.3.19
CVE-2026-49984
7.7
1%
Jun 26
Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
Affected: < 1.0.45; >= 1.1.0, < 1.3.23
CVE-2026-73246
7.5
1%
Aug 11
Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
Affected: < 1.3.31
CVE-2026-73245
6.5
0%
Aug 11
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Affected: < 2.0.0-rc6
CVE-2026-53577
6.5
0%
Jun 26
Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)
Affected: < 1.0.45; >= 1.1.0, < 1.3.21
CVE-2026-48129
6.5
0%
Jun 19
Kestra task inputFiles accepts traversal filenames for worker file writes
Affected: < 1.0.43; >= 1.1.0, < 1.1.19; >= 1.2.0, < 1.2.19; >= 1.3.0, < 1.3.19
Showing 12