CVE-2026-53576

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21

Description The authentication filter for the REST API @Filter("/api/v1/**") incorrectly treats any request path ending in /configs as a public instance-config endpoint, allowing requests to bypass Basic-Auth. This occurs because the platform identifies resources via caller-chosen URL path segments, such as /api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, and /api/v1/{tenant}/namespaces/{namespace}/kv/{key}. By using configs as the final segment, an unauthenticated user can access the flow-create and execution-trigger routes to create and run a flow containing a Shell or Process task. These tasks execute as root within the container, and since the official docker-compose.yml mounts /var/run/docker.sock, the attacker can gain access to the host Docker daemon.

Recommendations Update Kestra to version 1.0.45 or later. Update Kestra to version 1.3.21 or later.