What is the CVSS score of EUVD-2026-39920?

EUVD-2026-39920 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Kestra are affected by EUVD-2026-39920?

A security flaw in Kestra's file storage system (versions prior to 1.0.45 and 1.3.23) allows authenticated low-privilege users to bypass file-access restrictions and read sensitive files on affected…. A patch is available.

How to fix or mitigate EUVD-2026-39920?

Within 24 hours: Inventory all Kestra installations and document version numbers currently deployed. Within 7 days: Restrict execution-view role access to trusted administrators only; audit current role assignments and revoke unnecessary permissions. Within 30 days: Monitor Kestra's release channels for patched versions (1.0.45, 1.3.23, or later) and plan immediate deployment upon availability; implement host-level file-system restrictions (SELinux/AppArmor) to minimize Kestra's read scope.

Kestra EUVD-2026-39920

| CVE-2026-49984 HIGH

Path Traversal (CWE-22)

2026-06-26 GitHub_M

Path Traversal Microsoft Kestra Kestra Io

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network endpoint with low complexity, requires only the lowest authenticated role (PR:L); reading files outside the storage sandbox and across tenants is a scope change (S:C) with confidentiality-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 26, 2026 - 23:02 EUVD

Analysis Generated

Jun 26, 2026 - 21:52 vuln.today

CVE Published

Jun 26, 2026 - 20:55 cve.org

HIGH 7.7

DescriptionCVE.org

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past the guard using backslashes (..\..\..\); the guard sees a harmless string, and the path is only rewritten to ../../../ after validation, immediately before the file is opened. Any authenticated user who can view an execution (the lowest-privilege role) can call GET /api/v1/{tenant}/executions/{executionId}/file?path=… and read any file on the server filesystem readable by the Kestra process, outside the storage sandbox and across every tenant and namespace. This includes the embedded H2 database (all flows, all users, all stored secrets), internal storage of every other tenant/namespace, mounted secret files, and the process environment (/proc/self/environ) which contains configured database and secret-backend credentials. It is a complete breach of Kestra's storage isolation and multi-tenancy boundary. This vulnerability is fixed in 1.0.45 and 1.3.23.

AnalysisAI

Authenticated path traversal in Kestra's local internal-storage backend (versions prior to 1.0.45 and 1.3.23) lets any low-privilege user with execution-view access read arbitrary files on the host. The flaw stems from validation ordering: the guard checks for '..' sequences before backslashes are normalized to forward slashes, so a Windows-style '..\..\..\' payload bypasses the check and is rewritten to a real traversal only after validation. There is no public exploit identified at time of analysis, and EPSS/KEV signals are absent, but the confidentiality impact is severe because it breaks the multi-tenant storage isolation boundary.

Technical ContextAI

Kestra is an event-driven workflow orchestration platform whose 'local' internal-storage backend stores execution artifacts on the server filesystem and exposes them through GET /api/v1/{tenant}/executions/{executionId}/file?path=…. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically a validation-versus-canonicalization sequencing bug: the dot-dot guard runs against the raw input, then path separators are canonicalized (backslash → forward slash) afterward, so the sanitizer and the file-open call see two different strings. Because the rewrite happens immediately before the file is opened, the traversal escapes the storage sandbox and crosses tenant/namespace boundaries, reaching the embedded H2 database, other tenants' internal storage, mounted secret files, and /proc/self/environ. The single affected product per CPE is cpe:2.3:a:kestra-io:kestra:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a fixed release: Vendor-released patch: Kestra 1.0.45 (for the 1.0.x line) or 1.3.23 (for the 1.3.x line), per advisory GHSA-qw4v-6w32-xx9h (https://github.com/kestra-io/kestra/security/advisories/GHSA-qw4v-6w32-xx9h). If immediate patching is not possible, restrict the lowest-privilege execution-view role so untrusted or broad user populations cannot call the executions file endpoint, and place a reverse proxy or WAF rule in front of GET /api/v1/{tenant}/executions/{executionId}/file to reject path parameters containing backslashes or encoded '..' sequences - note this can break legitimate filenames that contain backslashes and must be tested. Consider migrating off the local internal-storage backend to an object-store backend (e.g., S3/GCS) where filesystem traversal does not apply, and rotate any credentials potentially exposed via /proc/self/environ, the H2 database, or mounted secret files, since the bug yields plaintext secret disclosure.