Quick answers
- Is CVE-2026-45807 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45807 being exploited in the wild.
- How severe is CVE-2026-45807?
- High severity, with a CVSS score of 7.7, published 26 June 2026.
- Which products and versions are affected?
- Kestra < 1.0.43, >= 1.1.0 < 1.3.19.
- Is there a fix for CVE-2026-45807?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-45807 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-45807?
- Check whether you run Kestra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in Kestra's `StorageInterface.parentTraversalGuard` due to improper validation of URL-encoded sequences. The guard checks the literal `URI.toString()` for '..' segments, which can be bypassed using encoded strings like `%2E%2E`. Downstream, `URI.getPath()` decodes these sequences back into '..', and the resulting path is passed to `Paths.get()` without normalization. An authenticated attacker with `EXECUTION:READ` permissions can exploit this via multiple API endpoints (e.g., `ExecutionController` and `NamespaceFileController`) to read any file accessible to the Kestra process, such as `/etc/passwd` or secrets. The issue is fixed in versions 1.0.43 and 1.3.19.
Affected products
- kestra-io kestra-core < 1.0.43, >= 1.1.0 < 1.3.19
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published by vendor
- 2026-06-26: disclosed: NVD publication date