CVE-2026-49984

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.23

Description The local internal-storage backend fails to properly validate user-supplied paths because it checks for directory traversal sequences before converting Windows-style backslashes to forward slashes. An attacker can bypass this guard by using backslashes (......), which are rewritten to forward slashes after validation, allowing access to files outside the storage sandbox. Any authenticated user with the lowest-privilege role can exploit this via the GET '/api/v1/{tenant}/executions/{executionId}/file' endpoint using the path parameter. This allows the reading of arbitrary server files accessible by the Kestra process, including the embedded H2 database, internal storage of other tenants, mounted secret files, and the process environment (/proc/self/environ) containing database and secret-backend credentials, resulting in a breach of storage isolation and multi-tenancy boundaries.

Recommendations Update to version 1.0.45. Update to version 1.3.23. Restrict access to the '/api/v1/{tenant}/executions/{executionId}/file' endpoint or avoid using the path parameter until the system is updated.