CVE-2026-73245 kestra-io CVE debrief

Who should care

Defenders responsible for Kestra deployments, particularly those with exposure to port 8081, should assess and mitigate this vulnerability to prevent potential configuration disclosure and log level manipulation.

Why it matters

CVE-2026-73245 allows unauthenticated access to Kestra's management endpoints, potentially disclosing configuration and allowing log level changes. Defenders should verify exposure, assess risks, and apply patches or mitigations.

• Potential configuration disclosure through unauthenticated GET /env requests.
• Possible log level manipulation via unauthenticated POST /loggers/{name} requests.
• Verification of Kestra deployment exposure to unauthenticated management endpoints is necessary.
• Patch application or mitigation is required to restrict access to management endpoints.

Technical summary

Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This vulnerability is addressed in Kestra version 2.0.0-rc6, which secures management endpoints with proper authentication mechanisms, preventing unauthorized access and potential configuration disclosure or log level manipulation. Defenders should prioritize verifying exposure and applying patches due to potential configuration disclosure and log level manipulation risks.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to potential configuration disclosure and log level manipulation risks.

Recommended defensive actions

• Verify Kestra deployment exposure to unauthenticated management endpoints on port 8081.
• Assess current log levels and configuration for potential manipulation.
• Apply patches or mitigations to restrict access to management endpoints.
• Monitor for suspicious activity related to /env and /loggers/{name} requests.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from Kestra's GitHub advisory and NVD detail page indicates unauthenticated access to management endpoints on port 8081, allowing GET /env and POST /loggers/{name} requests. The advisory highlights the importance of securing management endpoints to prevent configuration disclosure and log level manipulation. Defenders should verify Kestra deployments for exposure and apply patches or mitigations to secure management endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.