Kestra-io vulnerabilities
We track 9 vulnerabilities in Kestra-io products. 9 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on August 18, 2026.
Latest Kestra-io vulnerabilities
- 8.7 High severity
kestra: Improper Neutralization of Input During Web Page Generation
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler att
- 8.6 High severity
kestra: Server-Side Request Forgery
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client
- 7.5 High severity
kestra: Exposure of Sensitive Information to an Unauthorized Actor
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can exp
- 8.7 High severity
kestra: Use of Password Hash With Insufficient Computational Effort
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database
- 10.0 Critical severity
kestra: Improper Control of Generation of Code
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it
- 7.7 High severity
kestra: Improper Limitation of a Pathname to a Restricted Directory
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can theref
- 10.0 Critical severity
Kestra OSS OS Command Injection Exploited
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suf
- 7.7 High severity
kestra: Improper Limitation of a Pathname to a Restricted Directory
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the
- 9.0 Critical severity
kestra: Improper Neutralization of Special Elements used in an SQL Command
Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows