VulnSocial

CVE-2026-53577Disclosure(kestra / kestra)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.

kestra CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • kestra

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Exploit: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-26); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
kestra
Products
kestra

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-26: 2Mentions · 2026-06-30: 1Technical Details · 2026-06-30: 106-2606-30
Signal classification3 categories
Disclosure
133.3%
General
133.3%
Exploit
133.3%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-262
Disclosure1General1
2026-06-301
Exploit1
Full discourse3 posts
  • YogSotho@YogSoth0
    Exploit

    #Kestra Multi-CVE #Exploit Kit Multi-exploits kit for Kestra workflow orchestration platform vulnerabilities. CVEs Covered | CVE | CVSS | Description | |-----|------|-------------| | CVE-2026-49869 | 9.8 | Unauthenticated RCE via AuthenticationFilter bypass | | CVE-2026-53576 | 9.8 | Unauthenticated RCE via /configs path-suffix auth bypass | | CVE-2026-53577 | 7.7 | Cross-execution file read via preview endpoint (IDOR) | Impact: - #Unauthenticated flow creation and execution - #RCE as #root inside container - Host takeover via /var/run/docker.sock #0days #cybersecurity #security #hacking #antisec #infosec #CVSS

    Post summary

    This post presents a multi-CVE exploit kit for Kestra workflow orchestration platform, highlighting high‑severity RCE vulnerabilities but offering no concrete PoC, patch details, or evidence of active exploitation.

    0102391.4K
    1.9K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-53577 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{exe… https://www.cve.org/CVERecord?id=CVE-2026-53577 ----- Traducción: CVE-2026-53577 Kes… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-53577 for Kestra, noting a vulnerable previewFileFromExecution endpoint before versions 1.0.45 and 1.3.21, but provides no further exploitation or remediation details.

    0000033
    89 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-53577 Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{exe… https://www.cve.org/CVERecord?id=CVE-2026-53577

    Post summary

    The excerpt merely names CVE‑2026‑53577 in Kestra and references a vulnerable endpoint, but provides no detailed technical, exploit, or mitigation information.

    00000657
    57.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appkestrakestra---

Explore more

Back to dashboardkestra CVEskestra vulnerabilities