# kestra.

Every CVE that names kestra among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Kestra: Unauthenticated management \`/worker\` endpoint exposes live task configuration and plaintext credentials](https://agentprime.io/advisories/CVE-2026-73246.md)
  `CVE-2026-73246` · CVE record: kestra-io kestra · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Information disclosure, Authentication bypass
- [Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in \`AuthenticationFilter\`](https://agentprime.io/advisories/CVE-2026-49869.md)
  `CVE-2026-49869` · CVE record: kestra-io kestra · CVSS 10.0 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection, Authentication bypass, Server-side request forgery (SSRF), CWE-184
- [Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read](https://agentprime.io/advisories/CVE-2026-45807.md)
  `CVE-2026-45807` · CVE record: kestra-io kestra · CVSS 7.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal
- [Kestra: Path traversal in \`LocalStorage\` allows any authenticated user to read arbitrary server files via the execution file-download API (\`\\..\\\` bypasses the \`..\` guard)](https://agentprime.io/advisories/CVE-2026-49984.md)
  `CVE-2026-49984` · CVE record: kestra-io kestra · CVSS 7.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, Information disclosure, CWE-180
- [Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass](https://agentprime.io/advisories/CVE-2026-53576.md)
  `CVE-2026-53576` · CVE record: kestra-io kestra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Code injection, Authentication bypass
- [Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)](https://agentprime.io/advisories/CVE-2026-53577.md)
  `CVE-2026-53577` · CVE record: kestra-io kestra · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control
- [Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack](https://agentprime.io/advisories/CVE-2026-55069.md)
  `CVE-2026-55069` · CVE record: kestra-io kestra · CVSS 8.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Weak cryptography or TLS
- [Kestra task inputFiles accepts traversal filenames for worker file writes](https://agentprime.io/advisories/CVE-2026-48129.md)
  `CVE-2026-48129` · CVE record: kestra-io kestra · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal
- [Kestra: Remote Code Execution via SQL Injection](https://agentprime.io/advisories/CVE-2026-34612.md)
  `CVE-2026-34612` · CVE record: kestra-io kestra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: SQL injection
- [Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields](https://agentprime.io/advisories/CVE-2026-33664.md)
  `CVE-2026-33664` · CVE record: kestra-io kestra · CVSS 7.3 High · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Kestra: Stored Cross-Site Scripting in Markdown File Preview](https://agentprime.io/advisories/CVE-2026-29082.md)
  `CVE-2026-29082` · CVE record: kestra-io kestra · CVSS 7.3 High · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Kestra allows Stored XSS before 0.22](https://agentprime.io/advisories/CVE-2025-53543.md)
  `CVE-2025-53543` · CVE record: kestra-io kestra · CVSS 4.2 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=kestra>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/kestra/>. Everything for agents: <https://agentprime.io/llms.txt>.