What’s Vulnerable › Vulnerabilities

CVE-2026-73246: Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-200

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

Affected products

• kestra-io kestra: before 1.3.31

References

• https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46
• https://github.com/kestra-io/kestra/security/advisories/GHSA-m65f-q5gj-hg46

Get alerted when CVE-2026-73246 or the next vulnerability affects your stack