kestra-io kestra: critical vulnerability

kestra-io kestra

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check.

Fix it

Kestra is an

Upgrade to Kestra is an 1.0.45

io.kestra:kestra maven

On 1.3.20 and earlier?mvn versions:use-dep-version -Dincludes=io.kestra:kestra -DdepVersion=1.0.45 -DforceVersion=true
On 1.3.20 and earlier?mvn versions:use-dep-version -Dincludes=io.kestra:kestra -DdepVersion=1.3.21 -DforceVersion=true

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 06:17 UTC
Fixed in: io.kestra:kestra 1.3.21
io.kestra:kestra 1.0.45
Kestra is an 1.0.45
Identifiers: CVE-2026-53576
CVSS: 10.0
Source: news
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## kestra-io kestra: critical vulnerability
Severity: critical. Patch status: patched.
Affected: kestra-io kestra
Fixed in: io.kestra:kestra 1.3.21, io.kestra:kestra 1.0.45, Kestra is an 1.0.45
Ids: CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `io.kestra:kestra`. For each hit, compare the installed version with the fix on the same major line: io.kestra:kestra 1.3.21, io.kestra:kestra 1.0.45, Kestra is an 1.0.45. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. Fix by release line: io.kestra:kestra: <= 1.3.20 → 1.3.21; <= 1.3.20 → 1.0.45. Kestra is an: 1.0.45.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| io.kestra:kestra <= 1.3.20 | fixed | 1.3.21 | — |
| io.kestra:kestra <= 1.3.20 | fixed | 1.0.45 | — |
| Kestra is an | fixed | 1.0.45 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-53576") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f https://nvd.nist.gov/vuln/detail/CVE-2026-53576
https://pwned.coffee/i/kestra-security-advisory-cve-2026-53576

Timeline

27 Oct 2026, 06:17 UTC
Fix status: unknown → patched.
27 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-53576 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
io.kestra:kestra (maven) <= 1.3.20 1.3.21 GitHub advisory checked 27 Oct
io.kestra:kestra (maven) <= 1.3.20 1.0.45 GitHub advisory checked 27 Oct
Kestra is an before 1.0.45 1.0.45 CVE record (CNA) checked 27 Oct
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA GitHub_M) for CVE-2026-53576
Last checked: 27 Oct 2026, 06:17 UTC

Product	Affected	Fixed in	Source
io.kestra:kestra (maven)	<= 1.3.20	1.3.21	GitHub advisory checked 27 Oct
io.kestra:kestra (maven)	<= 1.3.20	1.0.45	GitHub advisory checked 27 Oct
Kestra is an	before 1.0.45	1.0.45	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee