What is the CVSS score of CVE-2026-73246?

CVE-2026-73246 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kestra are affected by CVE-2026-73246?

Kestra workflow orchestration platform versions prior to 2.0.0-rc6 expose plaintext credentials, environment variables, API keys, and database connection strings to any unauthenticated network user…. A patch is available.

How to fix or mitigate CVE-2026-73246?

Within 24 hours, inventory all Kestra instances in production and staging environments and confirm current versions. Within 7 days, upgrade all instances to version 2.0.0-rc6 or later (validate in non-production first), review access logs for evidence of unauthorized /worker endpoint access, and immediately rotate all credentials, API keys, and connection strings that may have been exposed through Kestra. Within 30 days, implement network segmentation to restrict access to Kestra worker ports to trusted internal systems only, disable external routing to worker processes, and conduct a full audit of secrets management practices within Kestra configurations.

Kestra CVE-2026-73246

EUVD-2026-57012 HIGH

Information Exposure (CWE-200)

2026-08-11 security-advisories@github.com

Information Disclosure Java

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated endpoint with no conditions; high confidentiality from plaintext credential exposure; no integrity or availability impact directly from this flaw.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 11, 2026 - 23:04 EUVD

Analysis Generated

Aug 11, 2026 - 22:38 vuln.today

CVE Published

Aug 11, 2026 - 22:19 cve.org

HIGH 7.5

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

AnalysisAI

Unauthenticated exposure of live task execution data in Kestra prior to 2.0.0-rc6 allows any network-accessible party to retrieve plaintext credentials, environment variables, HTTP headers, and connection strings via an unprotected GET /worker endpoint on the worker process. While the main Kestra API on port 8080 enforces authentication, the worker's WorkerEndpoint.java endpoint was not subject to the same controls, serializing the full live Task object to unauthenticated callers. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify network-accessible Kestra worker HTTP port

Delivery

Send unauthenticated GET /worker request

Exploit

Receive serialized live Task object

Execution

Extract plaintext credentials and connection strings

Persist

Authenticate to downstream systems using extracted secrets

Impact

Access or exfiltrate data from connected infrastructure

Access

Identify network-accessible Kestra worker HTTP port

Delivery

Send unauthenticated GET /worker request

Exploit

Receive serialized live Task object

Execution

Extract plaintext credentials and connection strings

Persist

Authenticate to downstream systems using extracted secrets

Impact

Access or exfiltrate data from connected infrastructure

Vulnerability AssessmentAI

Exploitation	The Kestra worker process's HTTP listener must be reachable from the attacker's network position - this is a separate listener from the main Kestra API on port 8080. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) is well-calibrated for this vulnerability: network-accessible, zero prerequisites, and high confidentiality impact from potential plaintext credential exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with network access to the Kestra worker process sends a single unauthenticated HTTP GET request to the /worker endpoint and receives a JSON-serialized Task object containing all in-flight execution context - including plaintext database passwords, cloud provider API keys, or other secrets embedded in workflow environment variables. The attacker extracts these credentials and uses them to authenticate directly to downstream systems such as databases, object storage, or cloud management consoles, converting a passive read into active infrastructure access. …
Remediation	Upgrade to Kestra 2.0.0-rc6 or later, the vendor-confirmed fix per GitHub security advisory GHSA-m65f-q5gj-hg46 (https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46). … Detailed patch versions, workarounds, and compensating controls in full report.