Executive brief
Kestra is an open-source platform used to automate and orchestrate complex data workflows. A security flaw allows unauthorized individuals to bypass login requirements by using specific web addresses that the system mistakenly identifies as public information. An attacker can exploit this to run malicious commands with administrative privileges, potentially leading to a complete takeover of the server and access to sensitive corporate data.
Technical details
An authentication bypass exists in Kestra's REST API filter due to improper path validation. The `AuthenticationFilter` uses a suffix-based check (`endsWith("/configs")`) to identify public configuration endpoints, which can be manipulated by an attacker who provides 'configs' as a resource identifier (e.g., namespace or flow ID). By crafting requests to endpoints like `/api/v1/{tenant}/flows/configs`, an unauthenticated attacker can bypass Basic-Auth to create and execute malicious flows. These flows execute as the root user within the Kestra container. In default deployments using the official docker-compose file, the container has access to the host's Docker socket, allowing the attacker to escalate privileges and achieve full host takeover. This issue is resolved in versions 1.0.45 and 1.3.21.
Affected products
- kestra-io kestra < 1.0.45, >= 1.1.0, < 1.3.21
Timeline
- 2026-06-03: advisory: GitHub advisory published by maintainers
- 2026-06-26: disclosed: NVD publication date