CVE-2026-73246 kestra-io CVE debrief

Who should care

Defenders responsible for Kestra deployments should assess exposure and prioritize upgrading to version 2.0.0-rc6 or later. This includes reviewing deployment configurations, verifying the presence of authentication mechanisms, and monitoring for suspicious activity on the worker endpoint. Security teams should also review compensating controls for exposed systems and track exceptions and remediation efforts.

Why it matters

CVE-2026-73246 is a high-severity vulnerability in Kestra that allows unauthenticated access to the worker endpoint, exposing sensitive task data. Defenders should prioritize verifying exposure and upgrading to version 2.0.0-rc6 or later.

• Potential exposure of sensitive task data
• Risk of unauthorized access to Kestra deployments
• Need for verification of deployment configurations
• Priority for upgrading to version 2.0.0-rc6 or later

Technical summary

The Kestra worker endpoint allows unauthenticated GET requests and exposes sensitive task data, including commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers. This vulnerability is particularly concerning because it allows attackers to access sensitive information without authentication, potentially leading to unauthorized access and data breaches. The issue is fixed in version 2.0.0-rc6, which likely includes authentication mechanisms for the worker endpoint.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 2.0.0-rc6 or later.

Recommended defensive actions

• Verify Kestra deployments for exposure to unauthenticated worker endpoint
• Upgrade to version 2.0.0-rc6 or later
• Monitor for suspicious activity on the worker endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected deployments and exploitation attempts is limited. There is no evidence of public exploitation, but defenders should verify their deployments and monitor for suspicious activity. The lack of authentication on the worker endpoint increases the risk of unauthorized access to sensitive task data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.