CVE-2026-45807

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.43 Kestra versions prior to 1.3.19

Description An authenticated user can perform a path traversal attack to read arbitrary files on the host filesystem that the process has access to, such as /etc/passwd or mounted secrets. This occurs because several API endpoints accept a kestra:// URI and use the StorageInterface.parentTraversalGuard function, which only inspects the literal string. By using a URL-encoded sequence %2E%2E (representing ..), an attacker can bypass this guard. The subsequent call to URI.getPath() decodes the sequence, and the resulting path is processed by Paths.get() without normalization, allowing the operating system to resolve the parent directory segments during the file open operation.

Recommendations Update to version 1.0.43. Update to version 1.3.19.