Login Request a demo
KE
Product
kestra
by kestra-io · last CVE Aug 18, 2026
On CISA KEVExploited in the wild
14
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities14In the news2Timeline
Severity mix
Critical 3High 6Medium 5Low 0
Severity
All severities14Critical3High6Medium5Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add kestra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73245
6.5
0%
Aug 11
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Affected: < 2.0.0-rc6
CVE-2026-53577
6.5
0%
Jun 26
Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)
Affected: < 1.0.45; >= 1.1.0, < 1.3.21
CVE-2026-48129
6.5
0%
Jun 19
Kestra task inputFiles accepts traversal filenames for worker file writes
Affected: < 1.0.43; >= 1.1.0, < 1.1.19; >= 1.2.0, < 1.2.19; >= 1.3.0, < 1.3.19
CVE-2026-33664
5.4
0%
Mar 26
Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields
Affected: <= 1.3.3
CVE-2026-29082
5.4
0%
Mar 6
Kestra: Stored Cross-Site Scripting in Markdown File Preview
Affected: <= 1.1.10
Showing 5