CVE-2026-45807: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in kestra-io kestra
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstream code then calls URI.getPath(), which decodes %2E%2E back to .., and the resulting path is handed to Paths.get(...) without normalization. The OS resolves the .. segments at open(2) time, so an authenticated user with a single execution can read any file the Kestra process has access to on the host filesystem (/etc/passwd, mounted secrets, other tenants' execution outputs, etc.). This vulnerability is fixed in 1.0.43 and 1.3.19.
AI Analysis
Technical Summary
Kestra, an open-source event-driven orchestration platform, has a path traversal vulnerability (CWE-22) in versions before 1.0.43 and 1.3.19. The vulnerability occurs because the StorageInterface.parentTraversalGuard only inspects the literal URI string without decoding URL-encoded characters. An attacker can bypass this check by using URL-encoded '..' sequences (%2E%2E), which are decoded later by URI.getPath(), resulting in directory traversal. The OS resolves these '..' segments at file open time, allowing an authenticated user to read any file accessible to the Kestra process on the host filesystem. This includes sensitive files such as /etc/passwd, mounted secrets, or other tenants' data. The vulnerability is addressed by fixes in versions 1.0.43 and 1.3.19.
Potential Impact
An authenticated user with limited privileges can exploit this vulnerability to read arbitrary files on the host filesystem that the Kestra process has access to. This can lead to disclosure of sensitive information such as system files, secrets, or data belonging to other tenants. The vulnerability does not allow code execution or modification of data but results in a confidentiality breach with high impact.
Mitigation Recommendations
This vulnerability is fixed in Kestra versions 1.0.43 and 1.3.19. Users should upgrade to at least one of these versions to remediate the issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version fixes stated in the description.
CVE-2026-45807: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in kestra-io kestra
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstream code then calls URI.getPath(), which decodes %2E%2E back to .., and the resulting path is handed to Paths.get(...) without normalization. The OS resolves the .. segments at open(2) time, so an authenticated user with a single execution can read any file the Kestra process has access to on the host filesystem (/etc/passwd, mounted secrets, other tenants' execution outputs, etc.). This vulnerability is fixed in 1.0.43 and 1.3.19.
CVSS v3.1
Score 7.7high
Affected software
pkg:github/kestra-io/kestraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kestra, an open-source event-driven orchestration platform, has a path traversal vulnerability (CWE-22) in versions before 1.0.43 and 1.3.19. The vulnerability occurs because the StorageInterface.parentTraversalGuard only inspects the literal URI string without decoding URL-encoded characters. An attacker can bypass this check by using URL-encoded '..' sequences (%2E%2E), which are decoded later by URI.getPath(), resulting in directory traversal. The OS resolves these '..' segments at file open time, allowing an authenticated user to read any file accessible to the Kestra process on the host filesystem. This includes sensitive files such as /etc/passwd, mounted secrets, or other tenants' data. The vulnerability is addressed by fixes in versions 1.0.43 and 1.3.19.
Potential Impact
An authenticated user with limited privileges can exploit this vulnerability to read arbitrary files on the host filesystem that the Kestra process has access to. This can lead to disclosure of sensitive information such as system files, secrets, or data belonging to other tenants. The vulnerability does not allow code execution or modification of data but results in a confidentiality breach with high impact.
Mitigation Recommendations
This vulnerability is fixed in Kestra versions 1.0.43 and 1.3.19. Users should upgrade to at least one of these versions to remediate the issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version fixes stated in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-13T08:19:32.604Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3eed5627e9c79719f4052f
Added to database: 06/26/2026, 21:21:26 UTC
Last enriched: 07/03/2026, 22:30:17 UTC
Last updated: 08/09/2026, 12:41:10 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.