CVE-2026-73245: Kestra unauthenticated management endpoints on port 8081

CVE-2026-73245 · Severity: medium · CVSS 6.5 · Published 2026-08-11

Kestra is an open-source orchestration and data-pipeline platform. The application exposes sensitive management endpoints on port 8081 without authentication, even when basic-auth is enabled on the main API (port 8080). An attacker with network access to port 8081 can read the application's full configuration including environment variables and change logging levels at runtime, completely bypassing the authentication controls that protect the main API.

Technologies: Kestra. Vendors: Kestra, Maven.

Quick answers

Is CVE-2026-73245 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73245 being exploited in the wild.
How severe is CVE-2026-73245?
Medium severity, with a CVSS score of 6.5, published 11 August 2026.
Which products and versions are affected?
Kestra v1.3.29 and likely earlier; io.kestra:kestra (Maven) < 2.0.0, ECOSYSTEM:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2026-73245?
Yes. io.kestra:kestra (Maven): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73245 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-73245?
Check whether you run Kestra or io.kestra:kestra (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.kestra:kestra (Maven): upgrade to 2.0.0 or later
    # set io.kestra:kestra to 2.0.0 in your pom.xml or build.gradle

Technical details

Kestra's Micronaut framework serves management/actuator endpoints (GET /env, POST /loggers/{name}, etc.) on a separate HTTP port 8081. The authentication filter that enforces basic-auth is scoped only to the main API endpoints on port 8080 (/api/v1/**) and does not apply to port 8081. An unauthenticated network client with access to port 8081 can enumerate the full application configuration via GET /env (including resolved environment variables and property sources, with credentials masked) and modify runtime state via POST /loggers/{name} to change log levels. No authentication or authorization checks are applied to these management endpoints. The default configuration and reference docker-compose.yml do not warn that port 8081 must be restricted to localhost only, creating a false sense of security when basic-auth is enabled on the main API. No patch has been released at the time of publication.

Affected products

  • Kestra Kestra v1.3.29 and likely earlier

Identifiers

  • CVE-2026-73245
  • GHSA-hpj9-grjp-7vc7

Timeline

  • 2026-09-17: disclosed
  • other: CVE-2026-73245 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.