CVE-2026-73246

Received Received - Intake

Authentication Bypass in Kestra Worker Endpoint

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73246

Affected Vendors & Products

Vendor	Product	Version / Range
kestra	kestra	to 2.0.0-rc6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Kestra is an open-source orchestration platform. A vulnerability exists in versions before 2.0.0-rc6 where an unauthenticated endpoint GET /worker exposes sensitive data. The endpoint serializes the entire live Task object, revealing commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers. The main API on port 8080 is protected but this endpoint bypasses authentication.

Detection Guidance

Check if Kestra is running a version prior to 2.0.0-rc6 by inspecting the version in use. Verify if the /worker endpoint is accessible without authentication on port 8080. Use curl commands like 'curl -v http://<kestra-server>:8080/worker' to test endpoint access.

Impact Analysis

This vulnerability allows attackers to access sensitive information such as plaintext credentials, environment variables, and internal commands. Attackers could use this data to escalate privileges, move laterally within systems, or gain unauthorized access to other resources. The exposure of execution identifiers may also enable attackers to track or interfere with ongoing processes.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized exposure of sensitive data including plaintext credentials and personal information. GDPR requires protection of personal data while HIPAA mandates safeguarding protected health information. The breach of credentials and internal data could lead to regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade Kestra to version 2.0.0-rc6 or later immediately. Ensure the /worker endpoint is not exposed publicly and restrict access to trusted networks or internal systems only.

Hi! I’m here to help you understand CVE-2026-73246. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70