Advisories · Technology
kestra.
Every CVE that names kestra among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
- kestra
- Information disclosure
- Authentication bypass
- CVSS 10.0 CriticalCritical · KEV, CVSS 9+KEV
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
- kestra
- Command injection
- Authentication bypass
- CVSS 7.7 High
Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
- kestra
- Path traversal
- CVSS 7.7 High
Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
- kestra
- Path traversal
- Information disclosure
- CVSS 10.0 CriticalCritical · CVSS 9+
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
- kestra
- Code injection
- Authentication bypass
- CVSS 6.5 Medium
Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)
- kestra
- Broken access control
- CVSS 8.7 High
Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
- kestra
- Weak cryptography or TLS
- CVSS 6.5 Medium
Kestra task inputFiles accepts traversal filenames for worker file writes
- kestra
- Path traversal
- CVSS 10.0 CriticalCritical · CVSS 9+
Kestra: Remote Code Execution via SQL Injection
- kestra
- SQL injection
- CVSS 7.3 High
Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields
- kestra
- Cross-site scripting (XSS)
- CVSS 7.3 High
Kestra: Stored Cross-Site Scripting in Markdown File Preview
- kestra
- Cross-site scripting (XSS)
- CVSS 4.2 Medium
Kestra allows Stored XSS before 0.22
- kestra
- Cross-site scripting (XSS)