CVE-2026-53577

Published: Jun 26, 2026Modified: Jul 1, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.

Affected (2)

Products: Kestra: Kestra

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Kestra Kestra	Before 1.0.45
Kestra Kestra	From 1.1.0 to 1.3.21

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.