CVE-2026-73246
Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.
| CWE | CWE-200 CWE-306 |
| Vendor | kestra-io |
| Product | kestra |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for kestra-io kestra
Be the first to know when new high vulnerabilities affecting kestra-io kestra are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
kestra-io / kestra
< 1.3.31