AIKIDO-2026-789992
kestra is vulnerable to Remote Code Execution
100
Critical Risk
This Affects:
kestraTL;DR
kestra's AuthenticationFilter skips Basic Auth for the public instance config endpoint when request.getPath() ends with /configs on the raw request path rather than the resolved route. Any API path ending in configs, such as /api/v1/main/flows/configs, skips that check. An unauthenticated user can then reach flow creation and execution, create a flow with a Shell or Process task, and run it as root in the container and on the host when the Docker socket is mounted, leading to remote code execution. The fix matches the resolved route rather than the raw path suffix.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
kestra is vulnerable to Remote Code Execution in versions 0.2.0 - 1.0.44 and 1.1.0 - 1.3.20.
How to fix this
Upgrade the kestra and/or the io.kestra:kestra library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.