VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jun 26, 2026· Updated Jul 1, 2026

CVE-2026-53577

CVE-2026-53577

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.

Affected products

2
  • Kestra/Kestra2 versions
    cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*range: <1.0.45
    • (no CPE)range: <1.0.45, <1.3.21

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.