Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` | * | 10.0 | KEV | 2.1% | 2026-06-27 |
| CVE-2026-55839 | Kestra: Stored XSS via custom Markdown [[link]] attribute injection | * | 8.7 | — | 2026-08-19 | |
| CVE-2026-73247 | Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata | * | 8.6 | — | 2026-08-12 | |
| CVE-2026-73246 | Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credential... | * | 7.5 | — | 2026-08-12 | |
| CVE-2026-73245 | Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-a... | * | 6.5 | — | 2026-08-12 | |
| CVE-2026-45807 | Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary fil... | * | 7.7 | — | 2026-06-27 | |
| CVE-2026-49984 | Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the... | * | 7.7 | — | 2026-06-27 | |
| CVE-2026-53576 | Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass | * | 10.0 | — | 2026-06-27 | |
| CVE-2026-53577 | Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) | * | 6.5 | — | 2026-06-27 | |
| CVE-2026-55069 | Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack | * | 8.7 | — | 2026-06-27 | |
| CVE-2026-48129 | Kestra task inputFiles accepts traversal filenames for worker file writes | * | 6.5 | — | 2026-06-20 | |
| CVE-2026-38428 | Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled inpu... | * | 9.8 | — | 2026-05-05 | |
| CVE-2026-34612 | Kestra: Remote Code Execution via SQL Injection | * | 10.0 | — | 2026-04-04 | |
| CVE-2026-33664 | Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields | * | 7.3 | — | 2026-03-27 | |
| CVE-2026-29082 | Kestra: Stored Cross-Site Scripting in Markdown File Preview | * | 7.3 | — | 2026-03-07 | |
| CVE-2025-53543 | Kestra allows Stored XSS before 0.22 | * | 4.2 | — | 2025-07-08 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).