CVE-2026-45807

{
  "id": "CVE-2026-45807",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T22:16:31.973",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstream code then calls URI.getPath(), which decodes %2E%2E back to .., and the resulting path is handed to Paths.get(...) without normalization. The OS resolves the .. segments at open(2) time, so an authenticated user with a single execution can read any file the Kestra process has access to on the host filesystem (/etc/passwd, mounted secrets, other tenants' execution outputs, etc.). This vulnerability is fixed in 1.0.43 and 1.3.19."
    },
    {
      "lang": "es",
      "value": "Kestra es una plataforma de orquestación de código abierto e impulsada por eventos. Antes de las versiones 1.0.43 y 1.3.19, varios puntos finales de la API de Kestra aceptan una URI kestra:// del cliente y la pasan a través de StorageInterface.parentTraversalGuard antes de leer el archivo subyacente del backend de almacenamiento local. El guard solo inspecciona la URI literal.toString(), por lo que un .. codificado en URL escrito como %2E%2E se cuela. El código posterior luego llama a URI.getPath(), que decodifica %2E%2E de nuevo a .., y la ruta resultante se entrega a Paths.get(...) sin normalización. El SO resuelve los segmentos .. en el momento de open(2), por lo que un usuario autenticado con una sola ejecución puede leer cualquier archivo al que el proceso de Kestra tenga acceso en el sistema de archivos del host (/etc/p4ssd, secretos montados, salidas de ejecución de otros inquilinos, etc.). Esta vulnerabilidad está corregida en las versiones 1.0.43 y 1.3.19."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kestra-io",
          "product": "kestra",
          "versions": [
            {
              "version": "< 1.0.43",
              "status": "affected"
            },
            {
              "version": ">= 1.1.0, < 1.3.19",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T12:13:25.005390Z",
          "id": "CVE-2026-45807",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.0.43",
              "matchCriteriaId": "C005B053-CC37-4203-91FE-98E3E249BAEB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.1.0",
              "versionEndExcluding": "1.3.19",
              "matchCriteriaId": "DED0B568-FA78-4A20-895C-100E445F8771"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-3529-p4wf-xp79",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-3529-p4wf-xp79",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}