PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53577 kestra-io CVE debrief

CVE-2026-53577 is a MEDIUM severity vulnerability in Kestra, an open-source, event-driven orchestration platform. The vulnerability exists in the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview), where an access control bypass allows any authenticated user to read output files from any other execution within the same tenant. This bypasses execution-level and namespace-level isolation. The vulnerability is fixed in versions 1.0.45 and 1.3.21 of Kestra.

Vendor
kestra-io
Product
kestra
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-26
Original CVE updated
2026-06-29
Advisory published
2026-06-26
Advisory updated
2026-06-29

Who should care

Users of Kestra, especially those with multi-tenant environments, should be aware of this vulnerability. Authenticated users within the same tenant can exploit this to access unauthorized execution output files. Administrators and security teams responsible for Kestra deployments should prioritize patching to versions 1.0.45 or 1.3.21.

Technical summary

The previewFileFromExecution endpoint in Kestra's API allows an authenticated user to preview files from executions. However, due to an access control bypass, this endpoint does not properly enforce execution-level and namespace-level isolation. As a result, any authenticated user can read output files from any other execution within the same tenant. This vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. The issue is addressed in Kestra versions 1.0.45 and 1.3.21.

Defensive priority

Patching to versions 1.0.45 or 1.3.21 is highly recommended. In the interim, restricting access to the previewFileFromExecution endpoint and closely monitoring API usage for suspicious activity can help mitigate the risk.

Recommended defensive actions

  • Patch Kestra to version 1.0.45 or 1.3.21
  • Restrict access to the previewFileFromExecution endpoint
  • Monitor API usage for suspicious activity
  • Review and update access controls for Kestra executions
  • Perform regular security audits on Kestra deployments

Evidence notes

The CVE-2026-53577 vulnerability is documented in the official CVE record and the NVD database. Additional information is available from the Kestra security advisory on GitHub. The vulnerability allows authenticated users to bypass access controls and read output files from other executions within the same tenant.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53577 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53577

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53577 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53577

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.