Executive brief
Kestra, an open-source event-driven orchestration platform, is vulnerable to a security flaw that allows authenticated users to bypass storage restrictions. By using specific character sequences in file paths, an attacker can escape the intended storage sandbox to read sensitive files on the server. This could lead to the exposure of internal databases, secret credentials, and configuration files, potentially compromising the entire platform and all data managed within it.
Technical details
A path traversal vulnerability (CWE-22) exists in Kestra's LocalStorage backend due to a 'validate-before-canonicalize' error (CWE-180). The `parentTraversalGuard` method checks for traversal sequences like '../' but fails to account for Windows-style backslashes ('..\'). The application subsequently calls `windowsToUnixPath`, which converts these backslashes into forward slashes after the security check has already passed. An authenticated attacker with the lowest-privilege role (viewing executions) can exploit the `GET /api/v1/{tenant}/executions/{executionId}/file` endpoint by smuggling a traversal sequence. This allows for arbitrary file read access to the server filesystem, including the H2 database, secrets, and process environment variables. The issue is fixed in versions 1.0.45 and 1.3.23.
Affected products
- kestra-io Kestra < 1.0.45, >= 1.1.0, < 1.3.23
Timeline
- 2026-06-26: advisory
- 2026-06-26: disclosed