By vendor

Kestra vulnerabilities

Known CVEs affecting Kestra products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-55069HIGH 8.7

  Kestra is an open-source workflow orchestration platform used to automate complex business processes. A vulnerability in versions prior to 1.3.24 allows attackers with database access to recover administrator credentials through offline password cracking. This is particularly dangerous in Kubernetes environments, where a compromised admin account can be leveraged to steal cluster tokens and secrets, granting access to the entire Kubernetes cluster and its workloads.

• CVE-2026-45807HIGH 7.7

  Kestra, an open-source workflow orchestration platform, contains a path traversal vulnerability in versions before 1.0.43 and 1.3.19. An authenticated user can craft a specially encoded request using %2E%2E (URL-encoded dots) to bypass the platform's path validation guard. Once the request reaches the file-reading logic, the encoded dots are decoded back to .. and allow navigation outside intended directories. An attacker with valid credentials can read sensitive files on the host system—including /etc/passwd, environment secrets, and other users' execution data—that the Kestra process has permission to access. The vulnerability requires authentication and affects the confidentiality of data stored on the server.

• CVE-2026-49984HIGH 7.7

  Kestra, an open-source workflow orchestration platform, contains a path-traversal vulnerability that allows authenticated users to read files anywhere on the server filesystem. The flaw exists because Kestra checks user-supplied file paths for directory traversal attacks using forward slashes, but an attacker can bypass this check by using Windows-style backslashes instead. After the validation passes, the backslashes are converted to forward slashes, enabling the traversal. Any user with the ability to view a workflow execution—the lowest privilege level in Kestra—can exploit this to escape the storage sandbox and read sensitive files across all tenants and namespaces, including databases, secrets, and system credentials.

• CVE-2026-53577MEDIUM 6.5

  Kestra, an open-source workflow orchestration platform, has an access control flaw in its file preview feature that allows any logged-in user to read output files from executions they shouldn't have access to. The vulnerability bypasses protections designed to isolate work between different execution runs and namespaces within the same tenant. An attacker with valid credentials—even a low-privileged user—can request files from any other execution and retrieve sensitive data. Versions 1.0.45 and 1.3.21 patch this issue.