CVE-2026-53577

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21

Description An access control bypass exists in the previewFileFromExecution endpoint (GET '/api/v1/{tenant}/executions/{executionId}/file/preview'). This issue allows an authenticated user to read output files from any other execution within the same tenant, effectively bypassing namespace-level and execution-level isolation. This is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input.

Recommendations Update to version 1.0.45. Update to version 1.3.21.