Kestra - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/kestra/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 01 Aug 2026 09:53:43 +0000Authentication Bypass and RCE in Kestra OSShttps://feed.craftedsignal.io/briefs/2026-08-kestra-auth-bypass/Sat, 01 Aug 2026 09:53:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-kestra-auth-bypass/Kestra OSS versions 1.3.20 and below are vulnerable to an authentication bypass via an incorrectly implemented filter, enabling unauthenticated remote code execution with root privileges.CVE-2026-53576 is a critical authentication bypass vulnerability affecting Kestra OSS versions up to v1.3.20. The vulnerability stems from a flaw in the authentication filter logic, specifically within AuthenticationFilter.java, which checks if a request path ends with the string /configs to determine if an endpoint is a configuration route. Because this check uses endsWith() rather than an exact match, an attacker can bypass authentication on any API endpoint by simply appending /configs to the requested URL. This allows unauthenticated users to create, modify, and execute arbitrary workflows. Successful exploitation grants an attacker the ability to execute system commands with root privileges, leading to full system compromise. If the Kestra instance is running within a container with the Docker socket mounted, an attacker can perform a container escape to gain control of the host machine.

Attack Chain

  1. Attacker identifies an internet-facing Kestra instance vulnerable to CVE-2026-53576.
  2. Attacker crafts a malicious API request targeting /api/v1/main/flows/configs to bypass authentication.
  3. Attacker submits a POST request to create a new flow containing arbitrary malicious commands.
  4. Attacker crafts a second request targeting /api/v1/main/executions/configs/configs to trigger the execution of the previously created malicious flow.
  5. The Kestra service executes the workflow, running the embedded commands with root privileges on the underlying host.
  6. Attacker leverages shell commands to establish a reverse shell or exfiltrate system data from the host.
  7. If the container environment is misconfigured, the attacker uses the exposed Docker socket to escape the container and compromise the host environment.

Impact

Successful exploitation results in full unauthorized control over the Kestra instance. Impacts include complete confidentiality loss (access to environment variables and secrets), loss of integrity (unauthorized modification of workflows), and full system compromise via RCE. In containerized environments, the lack of host isolation through improper Docker socket mounting facilitates container escapes, providing attackers with persistent host-level access.

Recommendation

  1. Upgrade all Kestra OSS deployments to a patched version immediately, as identified in the Kestra security advisory (GHSA-2q47-568g-9h4f).
  2. Deploy the Sigma rule below to detect exploitation attempts targeting the /configs bypass vector in web server logs.
  3. Remove any instances where /var/run/docker.sock is mounted into Kestra containers to prevent potential container escape scenarios.
  4. Implement strict network segmentation and restrict access to the Kestra management API using VPNs or IP whitelisting.
]]>criticaladvisorycve-2026-53576rceauthentication-bypasskestra