Executive brief
Kestra is an open-source orchestration and data-pipeline platform. The application exposes sensitive management endpoints on port 8081 without authentication, even when basic-auth is enabled on the main API (port 8080). An attacker with network access to port 8081 can read the application's full configuration including environment variables and change logging levels at runtime, completely bypassing the authentication controls that protect the main API.
Technical details
Kestra's Micronaut framework serves management/actuator endpoints (GET /env, POST /loggers/{name}, etc.) on a separate HTTP port 8081. The authentication filter that enforces basic-auth is scoped only to the main API endpoints on port 8080 (/api/v1/**) and does not apply to port 8081. An unauthenticated network client with access to port 8081 can enumerate the full application configuration via GET /env (including resolved environment variables and property sources, with credentials masked) and modify runtime state via POST /loggers/{name} to change log levels. No authentication or authorization checks are applied to these management endpoints. The default configuration and reference docker-compose.yml do not warn that port 8081 must be restricted to localhost only, creating a false sense of security when basic-auth is enabled on the main API. No patch has been released at the time of publication.
Affected products
- Kestra Kestra v1.3.29 and likely earlier
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-73245 assigned