CVE-2026-49984: Kestra Path Traversal Vulnerability

CVE-2026-49984 Overview

CVE-2026-49984 is a path traversal vulnerability [CWE-22] in Kestra, an open-source event-driven orchestration platform. The flaw affects versions prior to 1.0.45 and 1.3.23. The local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker smuggles a traversal sequence past the guard using backslashes such as ..\..\..\. The path is only rewritten to ../../../ after validation, immediately before the file is opened. Any authenticated user with the lowest-privilege execution-view role can read files across every tenant and namespace.

Critical Impact
Authenticated attackers can read the embedded H2 database, mounted secrets, /proc/self/environ, and internal storage of every tenant, breaching Kestra's multi-tenancy boundary.

Affected Products

Kestra versions prior to 1.0.45
Kestra versions prior to 1.3.23
Deployments using the local internal-storage backend

Discovery Timeline

2026-06-26 - CVE-2026-49984 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-49984

Vulnerability Analysis

The vulnerability resides in the local internal-storage backend, which handles file reads for execution artifacts. The backend performs traversal validation on the raw input string before normalizing separators. Because the guard inspects the payload before backslashes are converted to forward slashes, sequences such as ..\..\..\etc\passwd pass validation as opaque text. The path is then rewritten to ../../../etc/passwd and passed to the file open routine, escaping the storage sandbox.

An authenticated user calls GET /api/v1/{tenant}/executions/{executionId}/file?path=<traversal> to trigger the bug. The execution-view role is the lowest-privilege role in Kestra, which broadens the attacker population significantly. Successful exploitation yields arbitrary file reads within the process's filesystem permissions.

Root Cause

The root cause is order-of-operations in input sanitization. Path normalization must precede security checks, not follow them. Validating on a pre-normalized string allows encoding variants and alternate separators to bypass the guard. The pattern is a classic [CWE-22] path traversal caused by incomplete canonicalization.

Attack Vector

Exploitation requires network access to the Kestra API and a valid low-privilege account. The attacker crafts a path query parameter containing backslash-based traversal sequences. Reachable targets include the embedded H2 database file (flows, users, stored secrets), other tenants' internal storage, mounted secret files, and /proc/self/environ, which exposes database and secret-backend credentials configured on the process. The result is a complete breach of storage isolation and multi-tenancy.

No public proof-of-concept or exploit is currently available. See the Kestra GitHub Security Advisory GHSA-qw4v-6w32-xx9h for vendor-supplied technical details.

Detection Methods for CVE-2026-49984

Indicators of Compromise

HTTP requests to /api/v1/{tenant}/executions/{executionId}/file where the path parameter contains backslash sequences such as ..\ or URL-encoded %5c..%5c.
Access log entries showing execution-file reads returning unexpected content types or large payloads inconsistent with normal execution artifacts.
Kestra process file access to /proc/self/environ, H2 database files, or paths outside the configured storage root.

Detection Strategies

Deploy a web application firewall rule that decodes and normalizes the path query parameter, then rejects any request containing traversal tokens in either separator style.
Enable filesystem auditing (auditd or equivalent) on the Kestra data directory and alert on reads by the Kestra process outside the storage sandbox.
Correlate authentication events with execution-file API calls to identify low-privilege accounts issuing anomalous volumes of file requests.

Monitoring Recommendations

Forward Kestra API access logs and host filesystem audit events to a centralized analytics platform for retrospective hunting.
Baseline normal path parameter values per tenant and alert on outliers containing .., %2e%2e, or backslash characters.
Monitor for reads of sensitive artifacts such as H2 database files and /proc/*/environ from the Kestra service account.

How to Mitigate CVE-2026-49984

Immediate Actions Required

Upgrade Kestra to version 1.0.45 or 1.3.23 immediately, depending on your release branch.
Rotate all secrets accessible to the Kestra process, including database credentials, secret-backend tokens, and any values present in the process environment.
Audit execution-file API access logs for suspicious path parameters and treat any confirmed traversal as a full-scope compromise.

Patch Information

Kestra fixed the vulnerability in releases 1.0.45 and 1.3.23. The fix normalizes path separators before validation. Refer to the Kestra GitHub Security Advisory GHSA-qw4v-6w32-xx9h for release notes and upgrade guidance.

Workarounds

Restrict the execution-view role to trusted users until the upgrade is complete.
Place a reverse proxy in front of Kestra that rejects requests to /api/v1/*/executions/*/file containing backslashes or encoded traversal sequences in the path parameter.
Run the Kestra process with a minimal filesystem view via containerization or chroot so that traversal cannot reach host secrets or /proc.

bash

# Example NGINX rule to block backslash traversal in the path parameter
location ~ ^/api/v1/.+/executions/.+/file {
    if ($args ~* "(\\|%5c|\.\.)") { return 400; }
    proxy_pass http://kestra_upstream;
}