What is the CVSS score of CVE-2026-53577?

CVE-2026-53577 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-53577?

Yes, a patch is available for CVE-2026-53577. Update the affected software to the latest version immediately.

Kestra CVE-2026-53577

EUVD-2026-39918 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-26 GitHub_M

Authentication Bypass Kestra Kestra Io

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible REST endpoint requiring only a valid authenticated session (PR:L); purely a read bypass with no write or availability impact whatsoever.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 23:02 EUVD

Analysis Generated

Jun 26, 2026 - 21:50 vuln.today

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.

AnalysisAI

Unauthorized file read in Kestra's execution preview API allows any authenticated tenant user to access output files from executions they do not own, bypassing both execution-level and namespace-level isolation. Affected versions span the 1.0.x branch prior to 1.0.45 and the 1.3.x branch prior to 1.3.21. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and purely network-based exploitation path make this a meaningful risk in multi-tenant or shared Kestra deployments where execution output may contain sensitive pipeline data.

Technical ContextAI

Kestra is an open-source, event-driven workflow orchestration platform (CPE: cpe:2.3:a:kestra-io:kestra:*:*:*:*:*:*:*:*) that exposes a REST API for managing pipeline executions. The vulnerable endpoint - GET /api/v1/{tenant}/executions/{executionId}/file/preview - is designed to let users preview output files produced by a specific execution. CWE-863 (Incorrect Authorization) is the root cause class: the server authenticates the caller but fails to verify that the caller is authorized to access the requested executionId. Because the execution ID is the sole access control gate and no namespace or ownership check is enforced, any authenticated user within the same tenant can substitute an arbitrary executionId to read files belonging to executions they did not initiate. This is a classic Insecure Direct Object Reference (IDOR) pattern at the API layer.

RemediationAI

Upgrade to Kestra 1.0.45 (for deployments on the 1.0.x line) or Kestra 1.3.21 (for deployments on the 1.3.x line), as confirmed by the GitHub Security Advisory GHSA-r6v3-xxwj-9h42 at https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42. If an immediate upgrade is not feasible, compensating controls include restricting access to the /api/v1/{tenant}/executions/ endpoint at the network or API gateway layer to only known-authorized IP ranges or service accounts - note this may disrupt legitimate API consumers. Additionally, enforcing strict tenant user provisioning (minimizing the number of authenticated accounts per tenant) reduces the attack surface. There is no indication of a server-side configuration toggle to disable the preview endpoint selectively, so patching is the definitive remediation.