Authentication Bypass in Kestra Orchestration Platform by Kestra
CVE-2026-53576
Key Information:
Badges
What is CVE-2026-53576?
The Kestra orchestration platform suffers from an authentication bypass vulnerability in its REST API. Specifically, any request ending with '/configs' is treated as public, bypassing necessary credential checks. This lack of authentication allows unauthorized users to create and execute flows, potentially leading to execution of harmful tasks as root within the container. Since the container's configuration mounts the Docker socket, it poses a significant risk, enabling an attacker to control the host's Docker daemon. This issue has been mitigated in versions 1.0.45 and 1.3.21.
Affected Version(s)
kestra < 1.0.45 < 1.0.45
kestra >= 1.1.0, < 1.3.21 < 1.1.0, 1.3.21
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.