CyberRota Analysis
AI-GeneratedKestra's open-source orchestration platform versions prior to 2.0.0-rc6 expose management endpoints on port 8081 without authentication, despite Basic Auth being enforced on the primary API. This vulnerability allows unauthorized users to access sensitive configuration data and modify logging levels, potentially leading to information disclosure and operational disruption. Organizations using affected versions should prioritize upgrading to 2.0.0-rc6 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.