CVE-2026-73245

Received Received - Intake

Remote Code Execution in Kestra Orchestration Platform

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73245

Affected Vendors & Products

Vendor	Product	Version / Range
kestra	kestra	to 2.0.0-rc6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Kestra is an open-source orchestration platform. A vulnerability exists in versions before 2.0.0-rc6 where management endpoints on port 8081 are exposed without authentication. This allows unauthenticated access to sensitive information like configuration details and runtime settings.

Detection Guidance

Check if Kestra is running on version prior to 2.0.0-rc6. Use curl to test unauthenticated access to management endpoints on port 8081 with commands like 'curl http://localhost:8081/env' or 'curl -X POST http://localhost:8081/loggers/org.kestra.core' to see if configuration or log levels can be modified.

Impact Analysis

An attacker could exploit this to view sensitive configuration data via GET /env requests or modify runtime log levels via POST /loggers/{name} requests. This could lead to information disclosure or potential disruption of the Kestra service.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized disclosure or modification of configuration or logs may result in non-compliance.

Mitigation Strategies

Upgrade Kestra to version 2.0.0-rc6 or later to fix the issue. If immediate upgrade is not possible, restrict access to port 8081 using firewall rules or disable Micronaut management endpoints in the configuration file.

Hi! I’m here to help you understand CVE-2026-73245. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70