{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/kestra/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-53576"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kestra OSS"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-53576","rce","authentication-bypass","kestra"],"_cs_type":"advisory","_cs_vendors":["Kestra"],"content_html":"\u003cp\u003eCVE-2026-53576 is a critical authentication bypass vulnerability affecting Kestra OSS versions up to v1.3.20. The vulnerability stems from a flaw in the authentication filter logic, specifically within \u003ccode\u003eAuthenticationFilter.java\u003c/code\u003e, which checks if a request path ends with the string \u003ccode\u003e/configs\u003c/code\u003e to determine if an endpoint is a configuration route. Because this check uses \u003ccode\u003eendsWith()\u003c/code\u003e rather than an exact match, an attacker can bypass authentication on any API endpoint by simply appending \u003ccode\u003e/configs\u003c/code\u003e to the requested URL. This allows unauthenticated users to create, modify, and execute arbitrary workflows. Successful exploitation grants an attacker the ability to execute system commands with root privileges, leading to full system compromise. If the Kestra instance is running within a container with the Docker socket mounted, an attacker can perform a container escape to gain control of the host machine.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing Kestra instance vulnerable to CVE-2026-53576.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious API request targeting \u003ccode\u003e/api/v1/main/flows/configs\u003c/code\u003e to bypass authentication.\u003c/li\u003e\n\u003cli\u003eAttacker submits a POST request to create a new flow containing arbitrary malicious commands.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a second request targeting \u003ccode\u003e/api/v1/main/executions/configs/configs\u003c/code\u003e to trigger the execution of the previously created malicious flow.\u003c/li\u003e\n\u003cli\u003eThe Kestra service executes the workflow, running the embedded commands with root privileges on the underlying host.\u003c/li\u003e\n\u003cli\u003eAttacker leverages shell commands to establish a reverse shell or exfiltrate system data from the host.\u003c/li\u003e\n\u003cli\u003eIf the container environment is misconfigured, the attacker uses the exposed Docker socket to escape the container and compromise the host environment.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full unauthorized control over the Kestra instance. Impacts include complete confidentiality loss (access to environment variables and secrets), loss of integrity (unauthorized modification of workflows), and full system compromise via RCE. In containerized environments, the lack of host isolation through improper Docker socket mounting facilitates container escapes, providing attackers with persistent host-level access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Kestra OSS deployments to a patched version immediately, as identified in the Kestra security advisory (GHSA-2q47-568g-9h4f).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect exploitation attempts targeting the \u003ccode\u003e/configs\u003c/code\u003e bypass vector in web server logs.\u003c/li\u003e\n\u003cli\u003eRemove any instances where \u003ccode\u003e/var/run/docker.sock\u003c/code\u003e is mounted into Kestra containers to prevent potential container escape scenarios.\u003c/li\u003e\n\u003cli\u003eImplement strict network segmentation and restrict access to the Kestra management API using VPNs or IP whitelisting.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-01T09:53:43Z","date_published":"2026-08-01T09:53:43Z","id":"https://feed.craftedsignal.io/briefs/2026-08-kestra-auth-bypass/","summary":"Kestra OSS versions 1.3.20 and below are vulnerable to an authentication bypass via an incorrectly implemented filter, enabling unauthenticated remote code execution with root privileges.","title":"Authentication Bypass and RCE in Kestra OSS","url":"https://feed.craftedsignal.io/briefs/2026-08-kestra-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Kestra","version":"https://jsonfeed.org/version/1.1"}