CVE-2026-53576Disclosure(kestra / kestra)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch kestra kestra systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.

kestra CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-94CWE-288

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kestra

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
9 mentions across 6 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 5d ago at 3 mentions (2026-06-26); latest day: 1
9 total mentions across 6 days

Affected systems

Vendors

kestra

Products

kestra

Deep dive

Activity timeline9 mentions / 6d

Signal classification3 categories

Disclosure

444.4%

Patch

333.3%

General

222.2%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-26	3	Disclosure1General1Patch1
2026-06-27	1	Patch1
2026-06-29	1	Disclosure1
2026-06-30	2	General1Patch1
2026-07-21	1	Disclosure1
2026-08-06	1	Disclosure1

Full discourse9 posts

pdnuclei-bot@pdnuclei_bot51d
Disclosure
🚨 CVE-2026-53576 - critical 🚨 Kestra <= 1.3.20 - Remote Code Execution > Kestra <= 1.3.20 contains an authentication bypass caused by misclassification of /co... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-53576 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces CVE-2026-53576 as a critical authentication bypass that results in remote code execution in Kestra ≤ 1.3.20, and directs readers to a Nuclei template for further details.
01034101.6K
1.3K followersView on X
YogSotho@YogSoth087d
General
#Kestra Multi-CVE #Exploit Kit Multi-exploits kit for Kestra workflow orchestration platform vulnerabilities. CVEs Covered | CVE | CVSS | Description | |-----|------|-------------| | CVE-2026-49869 | 9.8 | Unauthenticated RCE via AuthenticationFilter bypass | | CVE-2026-53576 | 9.8 | Unauthenticated RCE via /configs path-suffix auth bypass | | CVE-2026-53577 | 7.7 | Cross-execution file read via preview endpoint (IDOR) | Impact: - #Unauthenticated flow creation and execution - #RCE as #root inside container - Host takeover via /var/run/docker.sock #0days #cybersecurity #security #hacking #antisec #infosec #CVSS
Post summary
The post lists several high‑severity CVEs for Kestra, identifies the types of vulnerabilities, and outlines potential impacts, but it offers no PoC, exploit, or mitigation details.
0102391.4K
1.9K followersView on X
Netlas.io@Netlas_io88d
Disclosure
CVE-2026-49869 & CVE-2026-53576: Two RCE vulnerabilities in kestra, 10.0 rating 😱 Recently disclosed vulnerabilities in Kestra allow an unauthenticated remote attacker to execute arbitrary code as root. 👉 https://nt.ls/58ToN
Post summary
Newly disclosed RCE vulnerabilities in Kestra (CVE-2026-49869 & CVE-2026-53576) rated 10/10, allowing unauthenticated attackers to execute code as root. No PoC, exploit, patch, or active exploitation evidence is provided.
01040883
7.7K followersView on X
Lyrie.ai@lyrie_ai67d
Disclosure
| CVE | CVSS | Description | |-----|------|-------------| | CVE-2026-49869 | 9.8 | Unauthenticated RCE via AuthenticationFilter bypass | | CVE-2026-53576
Post summary
This snippet discloses high‑severity CVEs with brief technical details, but provides no PoC, exploit code, or patch information.
2001030
326 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-53576 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats a… https://www.cve.org/CVERecord?id=CVE-2026-53576
Post summary
The CVE identifies a flaw in Kestra's REST API authentication filter in versions before 1.0.45 and 1.3.21, with patches available in newer releases.
00010658
57.7K followersView on X
DFIR Lab@DFIR_Lab88d
Patch
🚨 CRITICAL CVE-2026-53576 | CVSS 10.0 Kestra orchestration platform auth bypass allows unauthenticated RCE as root. Affects versions <1.0.45 & <1.3.21. Patch immediately! #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/0vGaRIVuRG
Post summary
A critical CVE-2026-53576 in the Kestra orchestration platform allows unauthenticated root RCE (CVSS 10.0); immediate patching is required.
0000054
55 followersView on X
ADK Cyber@ADKCyber90d
Patch
CVE-2026-53576 (CVSS 10.0) impacts Kestra orchestration platform. Organizations using it should update to patched versions without delay. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/wswEtVVXvw
Post summary
The tweet announces CVE-2026-53576 with a CVSS 10.0 score affecting Kestra and urges immediate patching, but it does not mention exploits, PoC, or active attacks.
0000043
92 followersView on X
SecAlerts@SecAlertsCo91d
Patch
🔓 Unauthenticated RCE in Kestra - CVSS 10. CVE-2026-53576 lets attackers bypass auth by crafting a path ending in /configs, skipping the API filter entirely. Update to 1.0.45 or 1.3.21 now. #infosec #RCE https://secalerts.co/vulnerability/CVE-2026-53576?utm_campaign=x https://t.co/Gk5qUqjiBs
Post summary
CVE-2026-53576 enables unauthenticated remote code execution in Kestra through a crafted /configs path, scoring 10 on CVSS. The vulnerability has been patched in releases 1.0.45 and 1.3.21, which are recommended for all affected installations.
0000097
846 followersView on X
Infoflowcloud@infoflowcloud91d
General
🚨*CVE* CVE-2026-53576 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats a… https://www.cve.org/CVERecord?id=CVE-2026-53576 ----- Traducción: CVE-2026-53576 Kes… http://infoflow.cloud`
Post summary
The post references CVE-2026-53576 for Kestra and notes a flaw in its REST API authentication filter, but offers no further technical or action details.
0000033
89 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	kestra	kestra	-	-	-

Explore more

Back to dashboard kestra CVEs kestra vulnerabilities

What researchers are saying

CVE-2026-53576

YogSotho[verified]@YogSoth0General

The post lists several high‑severity CVEs for Kestra, identifies the types of vulnerabilities, and outlines potential impacts, but it offers no PoC, exploit, or mitigation details.

Netlas.io[verified]@Netlas_ioDisclosure

Newly disclosed RCE vulnerabilities in Kestra (CVE-2026-49869 & CVE-2026-53576) rated 10/10, allowing unauthenticated attackers to execute code as root. No PoC, exploit, patch, or active exploitation evidence is provided.

Lyrie.ai[verified]@lyrie_aiDisclosure

This snippet discloses high‑severity CVEs with brief technical details, but provides no PoC, exploit code, or patch information.

DFIR Lab[verified]@DFIR_LabPatch

A critical CVE-2026-53576 in the Kestra orchestration platform allows unauthenticated root RCE (CVSS 10.0); immediate patching is required.

ADK Cyber[verified]@ADKCyberPatch

The tweet announces CVE-2026-53576 with a CVSS 10.0 score affecting Kestra and urges immediate patching, but it does not mention exploits, PoC, or active attacks.

pdnuclei-bot@pdnuclei_botDisclosure

The post announces CVE-2026-53576 as a critical authentication bypass that results in remote code execution in Kestra ≤ 1.3.20, and directs readers to a Nuclei template for further details.

CVE@CVEnewDisclosure

The CVE identifies a flaw in Kestra's REST API authentication filter in versions before 1.0.45 and 1.3.21, with patches available in newer releases.

SecAlerts@SecAlertsCoPatch

CVE-2026-53576 enables unauthenticated remote code execution in Kestra through a crafted /configs path, scoring 10 on CVSS. The vulnerability has been patched in releases 1.0.45 and 1.3.21, which are recommended for all affected installations.