Kestra CVE-2026-49984

Exploitation requires an authenticated account with at least the execution-view role (the lowest-privilege role per CVSS PR:L) and a target Kestra instance configured to use the local internal-storage backend, which is what serves files through the GET /api/v1/{tenant}/executions/{executionId}/file endpoint. The specific trigger is supplying a path with Windows-style backslash traversal ('..\..\..\'), which is validated before backslash-to-forward-slash normalization. Limiting factors: the attacker must have valid credentials and visibility of at least one execution, the deployment must use the local (not object-store) backend, and disclosure is bounded to files readable by the Kestra process user; no user interaction is needed and impact is confidentiality-only (no write or denial of service).

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (base 7.7, High) is internally consistent with the description: network-reachable, low complexity, requires only the lowest authenticated role, no user interaction, scope-changed (sandbox/tenant escape), with high confidentiality impact and no integrity or availability impact. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation - the priority rests on the technical impact rather than on observed in-the-wild use. The realistic risk is high for any multi-tenant Kestra deployment using the local storage backend because the lowest-privilege role can read every tenant's secrets and the H2 database; for single-tenant, trusted-user, or non-local-backend deployments the practical exposure is lower. The one signal to verify is whether a given environment actually uses the local internal-storage backend and grants execution-view access broadly, since those are the real preconditions.

A user holding only the execution-viewer role logs in, opens any execution they can see, and issues GET /api/v1/{tenant}/executions/{executionId}/file?path=..\..\..\proc/self/environ. The backslash-encoded traversal slips past the validation guard and is canonicalized just before the file is opened, returning the process environment containing database and secret-backend credentials; the attacker repeats this to dump the H2 database and other tenants' stored secrets. No public exploit is identified at time of analysis, but the network vector and low attack complexity make weaponization straightforward.