CVE-2026-53576: Kestra Authentication Bypass Vulnerability

CVE-2026-53576 Overview

CVE-2026-53576 is an authentication bypass vulnerability in Kestra, an open-source event-driven orchestration platform. The flaw resides in the REST API authentication filter @Filter("/api/v1/**"), which treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. Because Kestra addresses resources through caller-controlled URL path segments, an anonymous attacker appends the literal configs as the final segment to bypass Basic authentication. The bypass reaches flow-create and execution-trigger routes, enabling unauthenticated remote code execution as root inside the Kestra container. The vulnerability is fixed in versions 1.0.45 and 1.3.21.

Critical Impact
Unauthenticated attackers execute arbitrary commands as root inside the Kestra container and can pivot to the host Docker daemon through the mounted /var/run/docker.sock socket.

Affected Products

Kestra versions prior to 1.0.45 (1.0.x branch)
Kestra versions prior to 1.3.21 (1.3.x branch)
Kestra deployments using the official docker-compose.yml with /var/run/docker.sock mounted

Discovery Timeline

2026-06-26 - CVE-2026-53576 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-53576

Vulnerability Analysis

The vulnerability is a code injection flaw ([CWE-94]) rooted in an authentication filter matching error. Kestra's REST API authentication filter is registered against /api/v1/** and applies Basic authentication to all endpoints under that prefix. The filter carves out /configs as a public endpoint because the instance-config resource must be readable by anonymous clients.

The filter checks whether the request path ends in /configs rather than matching the exact endpoint path. Kestra also uses caller-supplied path segments to address resources, including /api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, and /api/v1/{tenant}/namespaces/{namespace}/kv/{key}. An attacker chooses the literal string configs as the final path segment and any protected route becomes unauthenticated.

Once the filter is bypassed, the attacker reaches the flow-create and execution-trigger endpoints. They register a flow definition containing a Shell or Process task and trigger its execution. The task runs as root inside the Kestra container. In the official Docker Compose deployment, /var/run/docker.sock is bind-mounted into the container, so root in the container controls the host Docker daemon and the underlying host.

Root Cause

The authentication filter uses a suffix match on the request path instead of a structural route comparison. It fails to account for user-controlled trailing path segments used by Kestra's resource routing, allowing attacker-chosen values to be interpreted as the public configs endpoint.

Attack Vector

Exploitation requires only network access to the Kestra REST API. The attacker sends an HTTP request to a protected flow or execution route with the literal configs appended as the terminal path segment. The request is treated as unauthenticated public traffic, the flow-create route accepts a definition containing a Shell task, and the execution-trigger route runs it as root. See the Kestra GitHub Security Advisory GHSA-2q47-568g-9h4f for technical details.

Detection Methods for CVE-2026-53576

Indicators of Compromise

HTTP requests to /api/v1/** paths where the final segment is the literal string configs and the target route is not the instance-config endpoint
New flow definitions containing io.kestra.plugin.scripts.shell.Commands or Process tasks created without a corresponding authenticated session
Execution logs showing shell processes spawned by the Kestra Java process running as UID 0
Outbound connections from the Kestra container to unfamiliar hosts following flow execution

Detection Strategies

Inspect reverse proxy or API gateway logs for /api/v1/ request paths ending in /configs that also contain resource keywords such as flows, executions, or namespaces
Alert on flow-create API calls (POST /api/v1/*/flows) originating from anonymous sessions or unexpected source IPs
Correlate docker.sock interactions from within the Kestra container against baseline behavior

Monitoring Recommendations

Enable Kestra audit logging and forward events to a centralized log platform for correlation
Monitor container process trees for shell interpreters (/bin/sh, /bin/bash) spawned by the Kestra JVM
Track flow definitions written to storage and flag new flows referencing shell or process plugins

How to Mitigate CVE-2026-53576

Immediate Actions Required

Upgrade Kestra to version 1.0.45 or 1.3.21 immediately
Restrict network access to the Kestra API to trusted management networks until the patch is applied
Audit flow definitions and execution history for unauthorized shell or process tasks created before patching
Rotate any secrets, tokens, or Docker credentials that were reachable from the Kestra container

Patch Information

The Kestra maintainers released fixes in versions 1.0.45 and 1.3.21. The patched authentication filter validates the resolved endpoint rather than performing a suffix match on the request path. Review the Kestra Security Advisory GHSA-2q47-568g-9h4f for release notes and upgrade guidance.

Workarounds

Place Kestra behind a reverse proxy that rejects /api/v1/** requests where the final path segment is configs unless the full path exactly matches the instance-config endpoint
Remove the /var/run/docker.sock bind mount from docker-compose.yml to prevent container-to-host escalation if the API is exploited
Run the Kestra container as a non-root user and drop unnecessary Linux capabilities
Require network-layer authentication (mutual TLS or VPN) in front of the Kestra API until upgrade is complete

bash

# Example reverse proxy rule (NGINX) to block the bypass pattern
location ~ ^/api/v1/.+/(flows|executions|namespaces)/.*/configs$ {
    return 403;
}