CVE-2026-53576

{
  "id": "CVE-2026-53576",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T22:16:32.840",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter(\"/api/v1/**\")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21."
    },
    {
      "lang": "es",
      "value": "Kestra es una plataforma de orquestación de código abierto e impulsada por eventos. Antes de las versiones 1.0.45 y 1.3.21, el filtro de autenticación para la API REST (@Filter(“/api/v1/**”)) trata cualquier solicitud cuya ruta termine en /configs como el punto final público de configuración de instancia y la reenvía sin una verificación de credenciales. Kestra direcciona sus recursos mediante segmentos de ruta de URL que el llamador elige (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). Un llamador anónimo elige el literal configs como el segmento final, y la solicitud omite completamente la autenticación Basic-Auth. Debido a que la omisión alcanza las rutas de creación de flujo y activación de ejecución, un llamador no autenticado crea un flujo que contiene una tarea Shell o Process y la ejecuta. La tarea se ejecuta como root dentro del contenedor kestra. El docker-compose.yml oficial monta /var/run/docker.sock, por lo que root en el contenedor alcanza el demonio Docker del host. Esta vulnerabilidad está corregida en las versiones 1.0.45 y 1.3.21."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "kestra-io",
          "product": "kestra",
          "versions": [
            {
              "version": "< 1.0.45",
              "status": "affected"
            },
            {
              "version": ">= 1.1.0, < 1.3.21",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T15:02:08.660345Z",
          "id": "CVE-2026-53576",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.0.45",
              "matchCriteriaId": "ADC0ED79-69EF-4A2A-9F07-4791ED97124F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.1.0",
              "versionEndExcluding": "1.3.21",
              "matchCriteriaId": "73FD0092-9076-4F1C-9B93-E59C09D30E21"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}