CyberRota Analysis
AI-GeneratedKestra versions prior to 2.0.0-rc6 are vulnerable due to an unauthenticated endpoint that exposes sensitive information, including plaintext credentials and execution identifiers, through the serialization of live Task objects. This vulnerability can lead to unauthorized access and potential exploitation of the system. Organizations using Kestra should prioritize upgrading to the fixed version to mitigate the risk of data exposure and ensure the security of their orchestration processes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.