What is the CVSS score of CVE-2026-29082?

CVE-2026-29082 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-29082?

Yes, a public proof-of-concept exploit is available for CVE-2026-29082. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-29082?

Within 24 hours: Identify all Kestra instances in production and document versions; restrict file preview functionality to trusted users only via access controls. Within 7 days: Implement network segmentation to limit Kestra access to essential personnel; disable the execution-file preview feature if operationally feasible; monitor for suspicious Markdown file uploads and preview activity. Within 30 days: Continuously monitor Kestra's release notes for patch availability; evaluate alternative orchestration platforms or implement Web Application Firewall (WAF) rules to sanitize HTML in responses; conduct security awareness training on phishing risks from compromised workflow sessions.

Kestra CVE-2026-29082

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-06 security-advisories@github.com

XSS Kestra

7.3

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticated user uploads Markdown file
Exploit

Preview renders with html:true enabled
Execution

Unsanitized HTML injected via v-html
Impact

Execute arbitrary JavaScript in victim browser

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Kestra versions 1.1.10 and prior with execution-file preview feature enabled. Requires authenticated user account (PR:L) and victim must view the malicious Markdown preview (UI:R).
Impact	CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Public exploit/POC available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Kestra versions 1.1.10 and earlier allow authenticated users to perform cross-site scripting (XSS) attacks through the execution-file preview feature, which renders unsanitized Markdown as HTML. An attacker with login credentials can inject malicious scripts that execute in other users' browsers, potentially leading to session hijacking or credential theft. Public exploit code exists and no patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 7.3

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. [CVSS 7.3 HIGH]

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Kestra. Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.

Know when Kestra gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

PoC Detected

Mar 10, 2026 - 21:00 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 17:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

Executive ViewAI

Why It Matters

Kestra orchestration platforms running version 1.1.10 or earlier are vulnerable to stored cross-site scripting (XSS) attacks through malicious Markdown file previews. Attackers can inject arbitrary HTML and JavaScript that executes in users' browsers, potentially compromising credentials, sessions, and sensitive workflow data accessible through the platform.

Business Impact: High

Compensating Controls

Disable the execution-file preview feature in Kestra UI if not operationally critical; restrict file upload and preview permissions to authenticated, trusted administrators only; implement WAF rules to strip or escape HTML tags from Markdown preview responses; deploy network segmentation to isolate Kestra instances and limit lateral movement; monitor user sessions and enforce re-authentication for sensitive workflow modifications; consider sandboxing Kestra in containerized environments with restricted permissions pending patch availability.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.