CVE-2026-73246 in Kestra
Summary
by MITRE • 08/12/2026
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Kestra orchestration platform stems from an insecure direct object reference flaw that exposes sensitive runtime information through an unauthenticated endpoint. The specific issue exists in the worker component's HTTP handler at worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java where the GET /worker endpoint lacks proper authentication mechanisms. This endpoint serves as a critical security gap because it provides access to the complete live Task object structure which contains extensive sensitive data elements including command execution parameters, environment variables, HTTP headers, connection details, and plaintext credentials that are normally protected within the system's secure execution environment.
The technical flaw represents a classic case of insufficient authentication and authorization controls that violates fundamental security principles. When an attacker accesses the unauthenticated /worker endpoint, they receive serialized task objects containing runtime information that would typically be restricted to authorized system components or administrators only. This exposure includes not only sensitive credential data but also execution identifiers and connection details that could enable further exploitation attempts against the orchestration platform's infrastructure.
The operational impact of this vulnerability is substantial as it provides attackers with comprehensive access to runtime secrets and execution parameters that could be leveraged for privilege escalation, lateral movement, or data exfiltration. The exposure of plaintext credentials within task objects creates immediate risk for systems that rely on Kestra for workflow automation, particularly in environments where sensitive data processing occurs. Additionally, the disclosure of connection details and execution identifiers could enable attackers to craft targeted attacks against specific system components or identify potential attack vectors for more sophisticated exploitation techniques.
This vulnerability aligns with CWE-285 (Improper Authorization) and CWE-312 (Cleartext Storage of Sensitive Information) classifications within the Common Weakness Enumeration framework, demonstrating how inadequate access controls combined with improper data handling can create severe security implications. The ATT&CK framework would categorize this as a privilege escalation technique through exposed sensitive information, potentially enabling attackers to move laterally within the orchestration environment or gain unauthorized access to downstream systems that depend on Kestra workflows.
The fix implemented in version 2.0.0-rc6 addresses this issue by enforcing proper authentication mechanisms on the /worker endpoint, ensuring that only authorized system components can access the serialized task objects. This mitigation aligns with security best practices for protecting sensitive runtime information and demonstrates the importance of implementing defense-in-depth strategies where even internal endpoints require appropriate access controls. Organizations using Kestra should immediately upgrade to version 2.0.0-rc6 or later to address this exposure, while also reviewing their overall orchestration platform security posture to identify potential additional vulnerabilities in similar components that might expose sensitive runtime information without proper authorization controls.