Kestra CVE-2026-53576

Exploitation requires only that the Kestra REST API (/api/v1/**) be network-reachable by the attacker and that the instance run a version prior to 1.0.45 or 1.3.21; the attacker simply chooses the literal final path segment configs to satisfy the flawed public-endpoint check (the auth filter forwards any path ending in /configs without credentials). No authentication, no user interaction, and no non-default configuration are needed for the auth bypass and unauthenticated flow-create/execution-trigger RCE as root. The escalation from container-root to host compromise additionally requires the deployment to bind-mount /var/run/docker.sock, which is the default in the official docker-compose.yml; instances that do not mount the Docker socket limit impact to root code execution within the container rather than host takeover.

This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores 10.0: network-reachable, low complexity, no privileges, no user interaction, scope change with total confidentiality, integrity, and availability impact. The bypass is a deterministic logic flaw requiring only that the attacker append /configs to a request path, so exploitation is automatable and reliable. KEV status is NO (not listed by CISA) and no EPSS score was provided in the input, so widespread mass-exploitation is not yet confirmed; however, absence of EPSS/KEV data does not lower the intrinsic risk given that the full exploit path is published in the vendor GHSA advisory. No public exploit identified at time of analysis, but the advisory's step-by-step description means weaponization barrier is minimal. Defenders should treat any internet-exposed pre-fix Kestra instance as critically at risk.

An attacker scanning for exposed Kestra instances sends an unauthenticated HTTP request to a flow-create route crafted so the path ends in the literal segment configs, bypassing Basic-Auth, and registers a flow containing a Shell task. They then trigger execution via the similarly bypassed execution route, and the task runs as root inside the container; because the official compose file mounts the Docker socket, the attacker issues Docker API calls to spawn a privileged container and take over the host. No POC is published yet, but the vendor advisory fully documents the path traversal of the auth filter, making this reliably reproducible.