Quick answers
- Is CVE-2026-49984 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49984 being exploited in the wild.
- How severe is CVE-2026-49984?
- High severity, with a CVSS score of 7.7, published 26 June 2026.
- Which products and versions are affected?
- Kestra < 1.0.45, >= 1.1.0, < 1.3.23.
- Is there a fix for CVE-2026-49984?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-49984 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-49984?
- Check whether you run Kestra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-22) exists in Kestra's LocalStorage backend due to a 'validate-before-canonicalize' error (CWE-180). The `parentTraversalGuard` method checks for traversal sequences like '../' but fails to account for Windows-style backslashes ('..\'). The application subsequently calls `windowsToUnixPath`, which converts these backslashes into forward slashes after the security check has already passed. An authenticated attacker with the lowest-privilege role (viewing executions) can exploit the `GET /api/v1/{tenant}/executions/{executionId}/file` endpoint by smuggling a traversal sequence. This allows for arbitrary file read access to the server filesystem, including the H2 database, secrets, and process environment variables. The issue is fixed in versions 1.0.45 and 1.3.23.
Affected products
- kestra-io Kestra < 1.0.45, >= 1.1.0, < 1.3.23
Timeline
- 2026-06-26: advisory
- 2026-06-26: disclosed