CVE-2026-73245 in Kestra
Summary
by MITRE • 08/12/2026
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Kestra orchestration platform represents a critical security flaw that undermines the platform's authentication mechanisms through improper endpoint exposure. This issue affects versions prior to 2.0.0-rc6 where the Micronaut management endpoints are accessible on port 8081 without requiring authentication, despite the presence of basic authentication for the primary API endpoints on port 8080. The flaw creates a dangerous scenario where attackers can bypass authentication controls and gain unauthorized access to sensitive operational information.
The technical implementation of this vulnerability stems from the misconfiguration of Micronaut's management endpoints within the application.yml configuration file. When the system is configured with basic authentication for the /api/v1/** endpoints on port 8080, the management endpoints on port 8081 remain exposed without any authentication requirements. This creates an attack surface where unauthenticated users can perform GET requests to the /env endpoint to retrieve resolved configuration parameters and POST requests to /loggers/{name} to modify runtime logging levels. The combination of these capabilities allows for both information disclosure and potential disruption of system operations.
The operational impact of this vulnerability is significant across multiple security dimensions. The ability to access resolved configuration through GET /env requests exposes sensitive information including database credentials, API keys, and other environment-specific parameters that could be leveraged in further attacks. Additionally, the POST /loggers/{name} functionality enables attackers to modify runtime logging levels, potentially allowing them to disable critical logging or enable verbose logging for data exfiltration purposes. This vulnerability directly violates the principle of least privilege and undermines the security posture of organizations relying on Kestra for workflow orchestration.
This issue maps to CWE-284 (Improper Access Control) and CWE-312 (Sensitive Data Exposure) within the Common Weakness Enumeration framework, demonstrating how misconfigured access controls can lead to unauthorized information disclosure. From an ATT&CK perspective, this vulnerability aligns with T1078 (Valid Accounts) and T1566 (Phishing) as attackers could potentially exploit the exposed endpoints after gaining initial access through social engineering or credential compromise. The vulnerability also relates to T1528 (Steal Application Access Token) when sensitive configuration data is exposed, and T1484 (Data Destructive) through potential log level manipulation that could disrupt system operations.
Organizations using affected Kestra versions should immediately upgrade to version 2.0.0-rc6 or later where the issue has been resolved. The mitigation strategy involves proper endpoint configuration within the application.yml file to ensure management endpoints are either properly secured with authentication or completely disabled when not required. Security teams should conduct thorough audits of all service configurations and implement network segmentation to limit access to management ports. Additionally, monitoring should be implemented to detect unauthorized access attempts to management endpoints, and regular security assessments should verify that authentication controls are properly enforced across all application interfaces.