PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45807 kestra-io CVE debrief

CVE-2026-45807 is a high-severity vulnerability in Kestra, an open-source, event-driven orchestration platform. The vulnerability exists in several Kestra API endpoints that accept a kestra:// URI from clients and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. An authenticated user can exploit this vulnerability to read any file on the host filesystem, including sensitive files such as /etc/passwd, mounted secrets, and other tenants' execution outputs. The vulnerability is fixed in Kestra versions 1.0.43 and 1.3.19. This CVE was published on June 26, 2026, and modified on June 29, 2026.

Vendor
kestra-io
Product
kestra
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Users of Kestra, especially those with sensitive data or high-security requirements, should be aware of this vulnerability and take immediate action to patch their systems. Security teams and administrators responsible for Kestra deployments should prioritize patching to prevent potential exploitation. Additionally, users with access to Kestra's API should be cautious of potential phishing attacks that could exploit this vulnerability.

Technical summary

The vulnerability in Kestra's API allows an authenticated user to bypass the StorageInterface.parentTraversalGuard by URL-encoding a .. segment as %2E%2E. This enables the user to read any file on the host filesystem by manipulating the kestra:// URI. The downstream code decodes the URI and hands the resulting path to Paths.get() without normalization, allowing the OS to resolve the .. segments at open(2) time. This vulnerability has a CVSS score of 7.7 and is classified as HIGH severity.

Defensive priority

High priority should be given to patching Kestra deployments to prevent exploitation of this vulnerability. Administrators should ensure that all Kestra instances are upgraded to versions 1.0.43 or 1.3.19, or later, as soon as possible.

Recommended defensive actions

  • Patch Kestra deployments to versions 1.0.43 or 1.3.19, or later.
  • Review and monitor Kestra API logs for potential exploitation attempts.
  • Implement additional security measures, such as restricting access to sensitive files and monitoring for suspicious activity.
  • Conduct a thorough inventory of Kestra deployments and prioritize patching based on risk and exposure.
  • Consider implementing compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent exploitation attempts.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. The source item URL provides additional metadata about the CVE. The reference to the Kestra security advisory provides further context and details about the vulnerability and its fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45807 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45807

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45807 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45807

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.