CVE-2026-53577: Kestra Access Control Bypass in File Preview Endpoint

Technical summary

The previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) implements insufficient authorization checks. While authentication is required, the endpoint does not properly validate that the requesting user has permission to access the specific execution whose files are being previewed. An authenticated attacker can manipulate the executionId parameter to access output artifacts from arbitrary executions within their tenant, circumventing execution-level and namespace-level isolation boundaries. This is classified as an authorization bypass (CWE-863) rather than an authentication failure, since the user must already possess valid credentials.

Business impact

Organizations running Kestra may face data exposure if execution outputs contain sensitive information—database credentials, API keys, personally identifiable information, or business logic—intended for isolation. The blast radius is limited to users within the same tenant, but can still be significant in multi-team or multi-environment deployments where strict data compartmentalization is expected. Compliance frameworks that require isolation (HIPAA, PCI-DSS, SOX) could be undermined if sensitive data flows through Kestra unexecutions and users can cross access boundaries.

Affected systems

Kestra versions prior to 1.0.45 (1.0.x branch) and prior to 1.3.21 (1.3.x branch) are vulnerable. Users must verify their installed version against the patch releases. The vulnerability requires the attacker to be an authenticated user of the Kestra instance, limiting exposure to insider threats or compromised accounts rather than anonymous internet exposure.

Exploitability

Exploitation requires valid authentication credentials and network access to the Kestra API endpoint. An attacker does not need administrative privileges—any authenticated user (including read-only or low-privilege roles) can exploit this. The attack requires only a simple HTTP GET request with a modified executionId parameter; no complex payload construction or race conditions are needed. The CVSS score of 6.5 (Medium) reflects that while confidentiality impact is high (unrestricted file access), the requirement for prior authentication and lack of integrity or availability impact keep the overall severity moderate.

Remediation

Upgrade Kestra to version 1.0.45 or later for the 1.0.x line, or to version 1.3.21 or later for the 1.3.x line. These versions implement proper authorization checks on the previewFileFromExecution endpoint to ensure users can only access executions and files they are permitted to view. Verify against the official Kestra release notes to confirm the version you deploy includes this fix.

Patch guidance

1. Audit your current Kestra deployment to determine which version is running (check /version endpoint or application logs). 2. Review the official Kestra GitHub releases and advisory for version 1.0.45 and 1.3.21 to confirm patch applicability to your branch. 3. Plan upgrade timing in a maintenance window; test patches in a non-production environment first. 4. After patching, monitor logs for any failed authorization checks to detect post-upgrade exploitation attempts. 5. If running a version between 1.0.45+ and 1.3.21 (e.g., version 1.1.x or 1.2.x), verify which branch you should upgrade to based on your deployment stability requirements.

Detection guidance

Monitor API access logs for repeated or anomalous requests to GET /api/v1/{tenant}/executions/{executionId}/file/preview from a single user account, especially with varying executionId values outside their typical work scope. Flag requests where the user's namespace or project does not match the target execution's namespace. Implement audit logging on file access within Kestra if available. Review IAM policies to ensure only intended service accounts and users have API access. Correlate execution file access with user identity and role to identify unauthorized cross-execution retrieval.

Why prioritize this

This vulnerability should be prioritized for patching because it enables lateral data movement within a tenant without administrator detection, poses confidentiality risk to sensitive orchestration artifacts, and exploitability is trivial once an attacker has any valid credential. However, the requirement for prior authentication and the Medium severity rating mean it is lower priority than critical RCE or authentication bypass flaws. Organizations with strict data compartmentalization requirements or regulated data in Kestra outputs should patch immediately.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a high confidentiality impact (an attacker can read any file) but low attack complexity, no user interaction required, and no integrity or availability impact. The score assumes an authenticated attacker; the requirement for valid credentials (PR:L) prevents the highest severity ratings. The scope is unchanged (users and attacker are both within the same system), limiting explosive cross-system impact.

Frequently asked questions