Kestra EUVD-2026-39918

Exploitation requires a valid authenticated session within the same Kestra tenant (PR:L per CVSS vector); unauthenticated access is not sufficient. The attacker must be able to reach the Kestra API over the network (AV:N). The vulnerability is present in default Kestra deployments - no special feature flag or non-default configuration is required beyond standard multi-user tenant operation. The primary limiting factor is authentication: an attacker without a valid tenant account cannot exploit this. Cross-tenant exploitation is also not possible - the bypass is scoped to the tenant identified in the URL path parameter. Exploitation is further limited by the attacker's ability to discover or enumerate valid executionId values belonging to other executions.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), reflecting a purely network-reachable, low-complexity flaw requiring only a valid authenticated session (PR:L). Confidentiality impact is rated High because arbitrary execution output files - potentially containing credentials, PII, API keys, or intermediate pipeline data - can be read by an unauthorized party. There is no integrity or availability impact. No EPSS score was provided in the input data; exploitation probability must be inferred from structural signals. The attack is automatable: no user interaction, no race conditions, no elevated privilege - just a valid session token and a guessable or enumerable execution ID. The absence of a CISA KEV entry and lack of reported POC code suggest no widespread opportunistic exploitation at this time, making this a targeted insider-threat or compromised-credential scenario in practice. For single-tenant or single-user Kestra deployments the risk is negligible; the severity scales directly with the number of tenants and sensitivity of execution output data.

An authenticated Kestra user with a valid low-privilege account within a shared tenant issues GET requests to /api/v1/{tenant}/executions/{executionId}/file/preview, substituting execution IDs belonging to other users or namespaces. Because execution IDs are often sequential or UUID-based and may be discoverable through API listing endpoints, the attacker enumerates IDs and retrieves output files - potentially exposing database credentials, API keys, or sensitive business data produced by other teams' pipelines. No public exploit code is required; standard HTTP tooling suffices.