What is the CVSS score of CVE-2026-53576?

CVE-2026-53576 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Kestra are affected by CVE-2026-53576?

Kestra orchestration platform versions prior to 1.0.45 and 1.3.21 can be fully compromised by unauthenticated attackers who gain root-level access to affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-53576?

Yes, a public proof-of-concept exploit is available for CVE-2026-53576. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-53576?

Within 24 hours: Identify all Kestra instances and verify versions (check for <1.0.45 in 1.0.x or <1.3.21 in 1.3.x branches); restrict network access to REST API endpoints. No public exploit has been identified at time of analysis, but the vulnerability is trivially reproducible from vendor guidance. Within 7 days: Upgrade all vulnerable instances to Kestra 1.0.45 or later (1.0.x) or 1.3.21 or later (1.3.x). Within 30 days: Audit Kestra logs for unauthorized flow creation and command execution; review container configurations to restrict Docker socket access.

Kestra CVE-2026-53576

EUVD-2026-39919 CRITICAL

Code Injection (CWE-94)

2026-06-26 GitHub_M

RCE Docker Code Injection Kestra Kestra Io

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable auth bypass with no privileges or interaction (AV:N/AC:L/PR:N/UI:N); container-to-host pivot via Docker socket is a scope change (S:C) with full C/I/A loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 23:02 EUVD

Analysis Generated

Jun 26, 2026 - 21:51 vuln.today

CVE Published

Jun 26, 2026 - 20:54 cve.org

CRITICAL 10.0

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.

Articles & Coverage 1

POC Kestra OSS Authentication Bypass Enables Unauthenticated RCE (CVE-2026-53576) Aug 01, 2026

AnalysisAI

Unauthenticated remote code execution in Kestra orchestration platform before 1.0.45 and 1.3.21 lets anonymous attackers fully compromise the host. The REST API authentication filter treats any request path ending in /configs as the public instance-config endpoint, so an attacker appending the literal segment configs (e.g. to flow-create or execution-trigger routes) bypasses Basic-Auth, creates a flow with a Shell/Process task, and executes commands as root inside the container; with the default docker-compose mounting /var/run/docker.sock, this pivots to the host Docker daemon. No public exploit identified at time of analysis, but the technique is fully described in the vendor advisory and is trivially reproducible.

Technical ContextAI

Kestra is an event-driven, open-source workflow orchestration platform whose REST API routes resources by caller-chosen URL path segments (e.g. /api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). The Micronaut security filter bound to @Filter("/api/v1/**") uses a naive suffix check: any path ending in /configs is forwarded as the unauthenticated public instance-config endpoint. The root cause maps to CWE-94 (Improper Control of Generation of Code / code injection) because the auth bypass exposes flow-create and execution-trigger routes, allowing an attacker to inject and run arbitrary Shell or Process task code. The affected component is cpe:2.3:a:kestra-io:kestra (all versions prior to the fixed releases). The CVSS scope change (S:C) reflects that code executes as root in the container and, via the bind-mounted Docker socket in the shipped docker-compose.yml, reaches the host Docker daemon - a security-authority boundary crossing from container to host.

RemediationAI

Vendor-released patch: upgrade to Kestra 1.0.45 (for the 1.0.x line) or 1.3.21 (for the 1.3.x line), per the advisory at https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f. If immediate patching is not possible, block or restrict network access to the /api/v1/ endpoints at a reverse proxy or WAF and explicitly deny requests whose normalized path ends in /configs from unauthenticated sources (trade-off: this may break legitimate use of the public instance-config endpoint and must be applied to the post-normalization path to avoid trivial encoding bypasses). Additionally remove the /var/run/docker.sock bind mount from docker-compose.yml so that container RCE cannot pivot to the host Docker daemon (trade-off: Docker-based task runners that rely on the host socket will stop working). Restrict Kestra's network exposure to trusted internal networks and place it behind authenticated ingress until upgraded.