CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46
https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Kestra es una plataforma de orquestación de código abierto y basada en eventos. Antes de la versión 2.0.0-rc6, el archivo worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java de Kestra sirve GET /worker sin autenticación y serializa el objeto Task completo en vivo, lo que puede exponer comandos, variables de entorno, encabezados HTTP, detalles de conexión, credenciales en texto plano e identificadores de ejecución mientras que la API principal en el puerto 8080 permanece protegida. Este problema se solucionó en la versión 2.0.0-rc6.

Information

Published : 2026-08-11 22:19

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73246

Mitre link : CVE-2026-73246

CVE.ORG link : CVE-2026-73246

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-73246", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73246", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T15:12:22.751282Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kestra-io", "product": "kestra", "versions": [{"status": "affected", "version": "< 1.3.31"}]}]}], "published": "2026-08-11T22:19:05.287", "references": [{"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46", "source": "security-advisories@github.com"}, {"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6."}, {"lang": "es", "value": "Kestra es una plataforma de orquestaci\u00f3n de c\u00f3digo abierto y basada en eventos. Antes de la versi\u00f3n 2.0.0-rc6, el archivo worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java de Kestra sirve GET /worker sin autenticaci\u00f3n y serializa el objeto Task completo en vivo, lo que puede exponer comandos, variables de entorno, encabezados HTTP, detalles de conexi\u00f3n, credenciales en texto plano e identificadores de ejecuci\u00f3n mientras que la API principal en el puerto 8080 permanece protegida. Este problema se solucion\u00f3 en la versi\u00f3n 2.0.0-rc6."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}