What is the CVSS score of CVE-2026-29082?

CVE-2026-29082 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Kestra are affected by CVE-2026-29082?

Kestra orchestration platforms running version 1.1.10 or earlier are vulnerable to stored cross-site scripting (XSS) attacks through malicious Markdown file previews.

Is there a public PoC exploit available for CVE-2026-29082?

Yes, a public proof-of-concept exploit is available for CVE-2026-29082. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-29082?

Within 24 hours: Identify all Kestra instances in production and document versions; restrict file preview functionality to trusted users only via access controls. Within 7 days: Implement network segmentation to limit Kestra access to essential personnel; disable the execution-file preview feature if operationally feasible; monitor for suspicious Markdown file uploads and preview activity. Within 30 days: Continuously monitor Kestra's release notes for patch availability; evaluate alternative orchestration platforms or implement Web Application Firewall (WAF) rules to sanitize HTML in responses; conduct security awareness training on phishing risks from compromised workflow sessions.

Kestra CVE-2026-29082

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-06 security-advisories@github.com

XSS Kestra

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 21:00 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 17:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.

AnalysisAI

Kestra versions 1.1.10 and earlier allow authenticated users to perform cross-site scripting (XSS) attacks through the execution-file preview feature, which renders unsanitized Markdown as HTML. An attacker with login credentials can inject malicious scripts that execute in other users' browsers, potentially leading to session hijacking or credential theft. Public exploit code exists and no patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Kestra. Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.