CVE-2026-73245: CWE-306: Missing Authentication for Critical Function in kestra-io kestra
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.
AI Analysis
Technical Summary
Kestra, an open-source event-driven orchestration platform, had a missing authentication vulnerability (CWE-306) in its Micronaut management endpoints served on port 8081. Prior to version 2.0.0-rc6, these endpoints were accessible without authentication, despite Basic Auth protecting the main API on port 8080. This allowed unauthenticated GET requests to /env to disclose configuration details and POST requests to /loggers/{name} to modify runtime log levels. The vulnerability is addressed in version 2.0.0-rc6.
Potential Impact
An attacker can access sensitive configuration information via unauthenticated GET /env requests and can alter runtime logging levels via unauthenticated POST /loggers/{name} requests. This could lead to information disclosure and potential interference with application logging behavior. There is no indication of impact on availability or integrity beyond logging level changes.
Mitigation Recommendations
Upgrade Kestra to version 2.0.0-rc6 or later, where this issue is fixed. No other mitigation is indicated or required.
CVE-2026-73245: CWE-306: Missing Authentication for Critical Function in kestra-io kestra
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.
CVSS v3.1
Score 6.5medium
Affected software
kestra-io
kestra
pkg:github/kestra-io/kestraRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kestra, an open-source event-driven orchestration platform, had a missing authentication vulnerability (CWE-306) in its Micronaut management endpoints served on port 8081. Prior to version 2.0.0-rc6, these endpoints were accessible without authentication, despite Basic Auth protecting the main API on port 8080. This allowed unauthenticated GET requests to /env to disclose configuration details and POST requests to /loggers/{name} to modify runtime log levels. The vulnerability is addressed in version 2.0.0-rc6.
Potential Impact
An attacker can access sensitive configuration information via unauthenticated GET /env requests and can alter runtime logging levels via unauthenticated POST /loggers/{name} requests. This could lead to information disclosure and potential interference with application logging behavior. There is no indication of impact on availability or integrity beyond logging level changes.
Mitigation Recommendations
Upgrade Kestra to version 2.0.0-rc6 or later, where this issue is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-11T17:18:01.597Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7b9aa7bf8831d5397a273e
Added to database: 08/11/2026, 21:56:55 UTC
Last enriched: 08/11/2026, 22:12:22 UTC
Last updated: 09/25/2026, 13:47:48 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.