KE
Vendor
kestra-io
14
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-55839 | KE kestra kestra-io | 8.7 | Aug 18 | Kestra: Stored XSS via custom Markdown [[link]] attribute injection |
| CVE-2026-73247 | KE kestra kestra-io | 8.6 | Aug 11 | Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata |
| CVE-2026-73246 | KE kestra kestra-io | 7.5 | Aug 11 | Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials |
| CVE-2026-73245 | KE kestra kestra-io | 6.5 | Aug 11 | Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth |
| CVE-2026-49869 In wildKEV | KE kestra kestra-io | 10.0 | Jun 26 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` |
| CVE-2026-45807 | KE kestra kestra-io | 7.7 | Jun 26 | Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read |
| CVE-2026-49984 | KE kestra kestra-io | 7.7 | Jun 26 | Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard) |
| CVE-2026-53576 | KE kestra kestra-io | 10.0 | Jun 26 | Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass |
| CVE-2026-53577 | KE kestra kestra-io | 6.5 | Jun 26 | Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) |
| CVE-2026-55069 | KE kestra kestra-io | 8.7 | Jun 26 | Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack |
| CVE-2026-48129 | KE kestra kestra-io | 6.5 | Jun 19 | Kestra task inputFiles accepts traversal filenames for worker file writes |
| CVE-2026-34612 | KE kestra kestra-io | 9.0 | Apr 3 | Kestra: Remote Code Execution via SQL Injection |
| CVE-2026-33664 | KE kestra kestra-io | 5.4 | Mar 26 | Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields |
| CVE-2026-29082 | KE kestra kestra-io | 5.4 | Mar 6 | Kestra: Stored Cross-Site Scripting in Markdown File Preview |