CVE-2026-53577: Kestra Auth Bypass Vulnerability

CVE-2026-53577 Overview

CVE-2026-53577 is a broken access control vulnerability in Kestra, an open-source event-driven orchestration platform. The flaw resides in the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview). Any authenticated user can read output files from any other execution within the same tenant. The endpoint fails to enforce execution-level and namespace-level isolation checks. The issue is tracked under CWE-863: Incorrect Authorization and is fixed in Kestra 1.0.45 and 1.3.21.

Critical Impact
Authenticated tenant users can retrieve sensitive execution output files belonging to other users, workflows, and namespaces, breaking multi-tenant data isolation guarantees.

Affected Products

Kestra versions prior to 1.0.45
Kestra versions 1.1.x through 1.3.20
Deployments relying on namespace-level isolation between tenant users

Discovery Timeline

2026-06-26 - CVE-2026-53577 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-53577

Vulnerability Analysis

Kestra orchestrates workflows and stores output artifacts on a per-execution basis. Execution outputs frequently contain sensitive data such as query results, credentials, API responses, and intermediate transformation files. The previewFileFromExecution API endpoint is designed to allow authorized users to preview files tied to a specific execution. In vulnerable releases, the handler authenticates the caller but does not verify that the caller has permission to view the referenced executionId or its owning namespace.

An authenticated user in a tenant can therefore supply any executionId present in that tenant and receive the associated output file. The bypass affects both execution-scoped and namespace-scoped role-based access controls. Because Kestra deployments commonly use namespaces to separate teams, projects, or environments, the flaw undermines the primary data segregation model of the platform.

Root Cause

The root cause is missing authorization enforcement inside the preview handler. The endpoint validates authentication and tenant membership, but omits the checks that confirm the caller is entitled to the specific execution and its parent namespace. This is a classic [CWE-863] incorrect authorization defect in a business-logic path.

Attack Vector

Exploitation requires network access to the Kestra API and valid credentials within the target tenant. An attacker enumerates or guesses execution identifiers, then issues an HTTP GET request to the preview endpoint with a target executionId and file path. The server returns the file contents without validating ownership. No user interaction is needed beyond the attacker's own request.

The vulnerability is described in prose only because no verified proof-of-concept has been published. Refer to the Kestra GHSA-r6v3-xxwj-9h42 advisory for vendor technical details.

Detection Methods for CVE-2026-53577

Indicators of Compromise

Requests to /api/v1/{tenant}/executions/{executionId}/file/preview where the requesting user is not the owner of the referenced execution or its namespace.
Sequential or enumeration-style access patterns against the preview endpoint from a single authenticated session.
Unusual volume of HTTP 200 responses to the preview endpoint from non-privileged accounts.

Detection Strategies

Correlate Kestra access logs with execution ownership metadata to flag preview requests that cross namespace boundaries.
Alert on any single account issuing preview requests against more than a defined threshold of distinct executionId values.
Baseline expected preview traffic per user and role, then flag deviations for review.

Monitoring Recommendations

Forward Kestra API access logs to a centralized log platform with retention sufficient for retrospective hunts.
Instrument the reverse proxy fronting Kestra to record the full request path and authenticated principal for the preview endpoint.
Review authentication events for accounts that begin accessing executions outside their usual namespace scope.

How to Mitigate CVE-2026-53577

Immediate Actions Required

Upgrade Kestra to 1.0.45 or 1.3.21 or later without delay.
Rotate any secrets, tokens, or credentials that may have appeared in execution output files accessible through the endpoint.
Audit historical access logs for the previewFileFromExecution endpoint since deployment to identify potential unauthorized access.

Patch Information

Kestra maintainers released fixed versions 1.0.45 and 1.3.21, which add the missing authorization checks to the previewFileFromExecution handler. Details are published in the Kestra security advisory GHSA-r6v3-xxwj-9h42.

Workarounds

Restrict network access to the Kestra API to trusted operators until patches are applied.
Reduce the population of authenticated users in shared tenants where feasible, limiting exposure to trusted principals only.
Block or filter requests to /api/v1/*/executions/*/file/preview at an upstream proxy for non-administrative users until upgrading.

bash

# Configuration example: temporary reverse-proxy block for the vulnerable endpoint
location ~ ^/api/v1/[^/]+/executions/[^/]+/file/preview$ {
    deny all;
    return 403;
}