Kestra CVE-2026-33664

Attacker must be authenticated as a flow author in Kestra versions ≤1.3.3 to craft malicious flow YAML with JavaScript in description, inputs[].displayName, or inputs[].description fields. Victim user must view or interact with the flow in their browser for XSS execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) indicates network-accessible exploitation with low complexity requiring low privileges (authenticated flow author) and user interaction. The 7.3 score reflects high confidentiality and integrity impact with unchanged scope. Real-world risk depends heavily on organizational access controls: environments where untrusted users can author flows face elevated risk, while installations restricting flow authorship to trusted administrators see reduced exposure. The UI:R requirement is minimal since viewing flows is routine operational activity, and input.displayName renders on load with zero clicks. EPSS and KEV data were not provided, but the lack of public exploit code and the authentication requirement suggest this is not an immediate mass-exploitation risk. Priority should be high for multi-tenant or low-trust environments, moderate for controlled enterprise deployments.

An authenticated attacker with flow authorship privileges crafts a malicious workflow containing JavaScript payloads in the flow description or input.displayName metadata fields. When administrators or operators view the flow list or workflow details through the Kestra web interface during routine monitoring or execution tasks, the embedded scripts execute in their browser context, allowing session hijacking, credential theft, or further actions performed with the victim's privileges within the Kestra platform. The input.displayName field provides zero-click exploitation as it renders immediately upon page load.