CVE-2026-45807Patch(kestra / kestra)

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch kestra kestra systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstream code then calls URI.getPath(), which decodes %2E%2E back to .., and the resulting path is handed to Paths.get(...) without normalization. The OS resolves the .. segments at open(2) time, so an authenticated user with a single execution can read any file the Kestra process has access to on the host filesystem (/etc/passwd, mounted secrets, other tenants' execution outputs, etc.). This vulnerability is fixed in 1.0.43 and 1.3.19.

kestra CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kestra

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-06-26); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

kestra

Products

kestra

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-26	2	Disclosure1Patch1
2026-06-30	1	Patch1

Full discourse3 posts

DFIR Lab@DFIR_Lab88d
Patch
🚨 HIGH: CVE-2026-45807 (CVSS 7.7) - Path traversal in Kestra orchestration platform allows authenticated users to read arbitrary files via URL-encoded bypass. Affects versions <1.0.43 & <1.3.19. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/gOJyZKLHD3
Post summary
A high‑severity path traversal vulnerability (CVE‑2026‑45807) in Kestra is disclosed with a CVSS of 7.7, and users are urged to apply the available patch immediately; no PoC or exploitation details are included.
0000047
55 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-45807 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pas… https://www.cve.org/CVERecord?id=CVE-2026-45807 ----- Traducción: CVE-2026-45807 Kes… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-45807 against Kestra, noting that older versions accept risky kestra:// URIs, and that newer releases (≥1.0.43, ≥1.3.19) presumably address the issue.
0000035
89 followersView on X
CVE@CVEnew91d
Patch
CVE-2026-45807 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pas… https://www.cve.org/CVERecord?id=CVE-2026-45807
Post summary
The CVE‑2026‑45807 vulnerability allows Kestra API endpoints to accept a kestra:// URI from the client; patch versions 1.0.43 and 1.3.19 address the issue, and no PoC, exploit, or active exploitation is indicated.
00000732
57.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	kestra	kestra	-	-	-

Explore more

Back to dashboard kestra CVEs kestra vulnerabilities