Skip to main content

Kestra EUVDEUVD-2026-39918

| CVE-2026-53577 MEDIUM
Incorrect Authorization (CWE-863)
2026-06-26 GitHub_M
Authentication Bypass Kestra
6.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-accessible REST endpoint requiring only a valid authenticated session (PR:L); purely a read bypass with no write or availability impact whatsoever.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Jun 26, 2026 - 23:02 EUVD
Analysis Generated
Jun 26, 2026 - 21:50 vuln.today

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.

AnalysisAI

Unauthorized file read in Kestra's execution preview API allows any authenticated tenant user to access output files from executions they do not own, bypassing both execution-level and namespace-level isolation. Affected versions span the 1.0.x branch prior to 1.0.45 and the 1.3.x branch prior to 1.3.21. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid Kestra tenant credentials
Delivery
Enumerate or guess target execution IDs via API or timing
Exploit
Craft GET request to /api/v1/{tenant}/executions/{targetId}/file/preview
Execution
Receive and exfiltrate execution output files
Impact
Extract sensitive data from pipeline artifacts
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session within the same Kestra tenant (PR:L per CVSS vector); unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), reflecting a purely network-reachable, low-complexity flaw requiring only a valid authenticated session (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Kestra user with a valid low-privilege account within a shared tenant issues GET requests to /api/v1/{tenant}/executions/{executionId}/file/preview, substituting execution IDs belonging to other users or namespaces. Because execution IDs are often sequential or UUID-based and may be discoverable through API listing endpoints, the attacker enumerates IDs and retrieves output files - potentially exposing database credentials, API keys, or sensitive business data produced by other teams' pipelines. …
Remediation Upgrade to Kestra 1.0.45 (for deployments on the 1.0.x line) or Kestra 1.3.21 (for deployments on the 1.3.x line), as confirmed by the GitHub Security Advisory GHSA-r6v3-xxwj-9h42 at https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Kestra

View all
CVE-2026-29082 HIGH POC
7.3 Mar 06

Kestra versions 1.1.10 and earlier allow authenticated users to perform cross-site scripting (XSS) attacks through the e
CVE-2026-49869 CRITICAL
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-53576 CRITICAL
10.0 Jun 26

Unauthenticated remote code execution in Kestra orchestration platform before 1.0.45 and 1.3.21 lets anonymous attackers
CVE-2026-55069 HIGH
8.7 Jun 26

Offline administrator password recovery in Kestra OSS (versions prior to 1.3.24) stems from its BasicAuth component stor
CVE-2026-45807 HIGH
7.7 Jun 26

Arbitrary file read in Kestra orchestration platform (versions prior to 1.0.43 and 1.3.19) lets an authenticated user wi
CVE-2026-49984 HIGH
7.7 Jun 26

Authenticated path traversal in Kestra's local internal-storage backend (versions prior to 1.0.45 and 1.3.23) lets any l
CVE-2026-33664 HIGH
7.3 Mar 26

Cross-site scripting in Kestra orchestration platform versions up to 1.3.3 enables authenticated flow authors to inject

CVE-2026-48129 MEDIUM
6.5 Jun 19

Path traversal in Kestra's `inputFiles` task mechanism allows remote attackers to write arbitrary files to the worker fi

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8
CVE-2024-38856 CRITICAL POC
9.8
CVE-2023-22518 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-39918 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy