What is the CVSS score of CVE-2026-55839?

CVE-2026-55839 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kestra are affected by CVE-2026-55839?

Kestra versions before 1.3.24 contain a stored cross-site scripting vulnerability in the Markdown renderer that allows any authenticated user with Flow editing permissions to inject malicious…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55839?

Yes, a public proof-of-concept exploit is available for CVE-2026-55839. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55839?

Within 24 hours, inventory all Kestra deployments and identify current versions, prioritizing production environments. Within 7 days, upgrade all affected instances to Kestra 1.3.24 or later; if immediate patching is not feasible, restrict Flow creation and editing permissions to trusted administrators only and implement browser-based Content Security Policy headers if supported by your deployment. Within 30 days, complete the patching of all Kestra environments, conduct a review of Flow descriptions created or modified in the past 90 days for suspicious JavaScript, and verify the fix by attempting to inject test payloads in a non-production environment to confirm remediation.

Kestra CVE-2026-55839

EUVD-2026-60976 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-18 GitHub_M

GHSA-34pm-923j-7wf8

XSS Kestra Kestra Io

8.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

Authenticated Flow-editor (PR:L) stores payload delivered to any reviewer (UI:R); XSS crosses browser security boundary (S:C) enabling full session compromise (C:H/I:H); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 18, 2026 - 16:36 vuln.today

Analysis Generated

Aug 18, 2026 - 16:36 vuln.today

Patch available

Aug 18, 2026 - 16:17 EUVD

CVE Published

Aug 18, 2026 - 15:27 cve.org

HIGH 8.7

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.

AnalysisAI

Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The attacker must be an authenticated Kestra user with at least Low-privilege access - specifically, permission to create or edit Flows in any namespace (CVSS PR:L reflects this requirement). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.7 High rating with S:C accurately reflects cross-boundary impact: attacker privilege is bounded to Flow edit rights (PR:L), but execution occurs in a different user's browser context, potentially targeting administrators or namespace owners. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Kestra v1.3.24, available at https://github.com/kestra-io/kestra/releases/tag/v1.3.24. … Detailed patch versions, workarounds, and compensating controls in full report.