Medium severity6.5NVD Advisory· Published Aug 11, 2026· Updated Oct 23, 2026
CVE-2026-73245
CVE-2026-73245
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.kestra:kestraMaven | < 2.0.0 | 2.0.0 |
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.