Kestra CVE-2026-73246

The Kestra worker process's HTTP listener must be reachable from the attacker's network position - this is a separate listener from the main Kestra API on port 8080. No authentication, session token, special configuration flag, or user interaction is required; the GET /worker endpoint returns data to any caller that can reach it. The sensitivity of exposed data is conditional on what tasks are actively executing at the time of the request: if no tasks are running, the response may be empty or minimal, but during active workflow execution, plaintext credentials and connection details are included. Exploitation is bounded by network segmentation: worker processes isolated to internal networks or protected by host-based firewall rules are not reachable by external attackers. All Kestra versions prior to 2.0.0-rc6 are affected regardless of any other configuration.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) is well-calibrated for this vulnerability: network-accessible, zero prerequisites, and high confidentiality impact from potential plaintext credential exposure. This is not a case of inflated CVSS against low real-world risk - the attack is a single unauthenticated HTTP GET request, requiring no exploit tooling and no special knowledge of the target beyond the worker port. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists and no public POC has been identified at time of analysis, which moderates urgency somewhat. The critical limiting factor is network exposure of the worker endpoint: organizations with proper network segmentation that isolate Kestra worker processes from untrusted networks substantially reduce real-world risk. However, the secondary impact of exposed credentials - which could enable pivot into databases, cloud accounts, or downstream infrastructure - means the effective blast radius may far exceed what the S:U scope indicates.

An attacker with network access to the Kestra worker process sends a single unauthenticated HTTP GET request to the /worker endpoint and receives a JSON-serialized Task object containing all in-flight execution context - including plaintext database passwords, cloud provider API keys, or other secrets embedded in workflow environment variables. The attacker extracts these credentials and uses them to authenticate directly to downstream systems such as databases, object storage, or cloud management consoles, converting a passive read into active infrastructure access. No public POC has been identified, but the attack requires no specialized tooling beyond curl or a browser.