These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-55839 is a high-severity vulnerability in Kestra, an open-source event-driven orchestration platform. The vulnerability allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through custom Markdown syntax, resulting in stored cross-site scripting (XSS) when another user views the description or information panel. This issue was fixed in [truncated]
CVE-2026-73247 is a high-severity vulnerability in Kestra, an open-source event-driven orchestration platform. An unauthenticated attacker can exploit this vulnerability by importing and executing a flow that accesses internal services or cloud metadata due to the platform's lack of restrictions on private, loopback, or link-local destinations. This could lead to potential access to sensitive information [truncated]
CVE-2026-73246 is a high-severity vulnerability in Kestra, an open-source event-driven orchestration platform. Prior to version 2.0.0-rc6, the platform's worker endpoint allows unauthenticated access and exposes sensitive task data, including commands, environment variables, and credentials. This issue is fixed in version 2.0.0-rc6. The vulnerability allows attackers to access sensitive information withou [truncated]
CVE-2026-73245 debrief: Kestra's unauthenticated management endpoints on port 8081 allow configuration disclosure and log level changes, posing risks to deployments. Defenders should verify exposure, assess risks, and apply patches or mitigations to restrict access to management endpoints, ensuring configuration security and log integrity. This issue is fixed in version 2.0.0-rc6 of Kestra, which addresse [truncated]
CVE-2026-55069 is a high-severity vulnerability in the Kestra OSS workflow orchestration platform's BasicAuth authentication component. An attacker with read access to the PostgreSQL database can exploit this vulnerability to recover the administrator password offline due to SHA-512's high computation speed. In Kubernetes deployments, a successful crack enables reading of the cluster ServiceAccount Token [truncated]
CVE-2026-53577 is a MEDIUM severity vulnerability in Kestra, an open-source, event-driven orchestration platform. The vulnerability exists in the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview), where an access control bypass allows any authenticated user to read output files from any other execution within the same tenant. This bypasses execution-level and n [truncated]
CVE-2026-53576 is a critical vulnerability in Kestra, an open-source, event-driven orchestration platform. The vulnerability exists in the authentication filter for the REST API, which incorrectly treats requests ending in /configs as the public instance-config endpoint, bypassing Basic-Auth checks. This allows unauthenticated attackers to create flows and trigger executions, potentially leading to code e [truncated]
CVE-2026-49984 is a high-severity vulnerability in Kestra's internal-storage backend. Prior to versions 1.0.45 and 1.3.23, the backend validates user-supplied paths for .. traversal before converting Windows-style backslashes to forward slashes. An attacker can exploit this by smuggling a traversal sequence using backslashes, allowing them to read any file on the server filesystem readable by the Kestra p [truncated]
CVE-2026-45807 is a high-severity vulnerability in Kestra, an open-source, event-driven orchestration platform. The vulnerability exists in several Kestra API endpoints that accept a kestra:// URI from clients and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. An authenticated user can exploit this vulnerability to read any file on [truncated]
CVE-2026-34612 is a SQL Injection vulnerability in Kestra, leading to Remote Code Execution (RCE) via the /api/v1/main/flows/search endpoint. The vulnerability requires authentication and can be triggered by visiting a crafted link. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., running arbitrary OS commands on the host. This issue was patched in version 1.3.7. The vulnerabi [truncated]