Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-53576: Kestra REST API allows unauthenticated access to sensitive data

CVE-2026-53576

Summary

Prior to Kestra version 1.0.45 and 1.3.21, an attacker could bypass authentication and create a flow that runs as the root user. This could allow the attacker to access sensitive data on the host system. To fix this issue, update to version 1.0.45 or 1.3.21 or later.

Original title

Original description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.

nvd CVSS3.1 10.0

Vulnerability type

CWE-94 Code Injection

CWE-288 Authentication Bypass Using Alternate Path

https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f

Published: 26 Jun 2026 · Updated: 23 Jul 2026 · First seen: 26 Jun 2026