Kestra CVE-2026-73245

Exploitation requires that port 8081 (Micronaut management port) be reachable from the attacker's network - this is the primary limiting factor. If Kestra is deployed with port 8081 bound only to localhost or a private network interface, remote exploitation is blocked at the network layer. The vulnerability is specifically triggered when Basic Auth is configured on port 8080 for /api/v1/** but no equivalent authentication is applied to port 8081, which reflects the default application.yml shipped with Kestra prior to 2.0.0-rc6. No authenticated session, no special headers, and no non-default feature flags are required - the Micronaut management endpoints are enabled by default. Exploitation is limited by: (1) network reachability of port 8081, (2) the actual secrets present in the resolved /env output varying by deployment, and (3) the log-level manipulation impact depending on what logging Kestra is performing.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5 (Medium), but the vendor-assigned C:L for confidentiality likely understates real-world impact. Resolved configuration in an orchestration platform routinely includes database credentials, cloud provider secrets, and integration API keys - disclosing these could enable full compromise of connected systems, a blast radius far exceeding what C:L implies. The I:L for log-level manipulation is accurate in isolation but could be abused to suppress audit trails ahead of further attacks. No EPSS data was provided in source intelligence, preventing probabilistic exploitation forecasting. The vulnerability is not in CISA KEV and no public POC is known, reducing urgency slightly. However, the zero-complexity exploitation path (unauthenticated GET to a known port) means any internet-exposed Kestra instance with port 8081 reachable is trivially exploitable. SSVC signals suggest: exploitation status = PoC-none but trivially constructible; automatable = yes (no interaction needed); technical impact = partial (config read + log tamper). Priority should be elevated for deployments with port 8081 internet-accessible.

An attacker with network access to port 8081 of a Kestra deployment - whether through internet exposure, VPN access, or lateral movement within a cloud environment - sends an unauthenticated HTTP GET to /env and receives the fully resolved Kestra configuration in response, potentially including database passwords, object storage credentials, or third-party API keys used by orchestrated workflows. With those credentials, the attacker pivots to connected data stores or cloud services. No exploit tooling beyond curl is required, and no public POC has been identified at time of analysis.