CVE-2026-55839: Kestra Stored XSS Vulnerability

CVE-2026-55839 Overview

CVE-2026-55839 is a stored cross-site scripting (XSS) vulnerability in Kestra, an open-source, event-driven orchestration platform. The flaw resides in the custom Markdown parser located at ui/src/utils/markdown_plugins/link.ts. Users with permission to create or update a Flow description can inject JavaScript event-handler attributes through the custom [[link]] syntax. When another user opens the description or information panel in the Flow list, the injected script executes in their browser session. The issue affects Kestra versions prior to 1.3.24 and is tracked under [CWE-79].

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the browser of any user viewing an affected Flow description, enabling session compromise and account takeover.

Affected Products

Kestra orchestration platform versions prior to 1.3.24
Kestra UI component ui/src/utils/markdown_plugins/link.ts
Flow description rendering in the Kestra web interface

Discovery Timeline

2026-08-18 - CVE-2026-55839 published to NVD
2026-08-18 - Last updated in NVD database
v1.3.24 - Kestra releases patched version resolving the issue

Technical Details for CVE-2026-55839

Vulnerability Analysis

The vulnerability originates in Kestra's custom Markdown parser that handles the proprietary [[link]] syntax used to render internal navigation links to executions, flows, and namespaces. The parser accepted arbitrary attribute name-value pairs and forwarded them to the rendered link_custom_open token without filtering. Attackers with Flow edit privileges could embed JavaScript event handlers such as onclick, onmouseover, or onerror inside a Flow description. When another user opened the Flow list description or information panel, the browser executed the attacker-supplied script in the context of the Kestra origin.

Root Cause

The root cause is missing attribute allowlisting in the custom link tokenizer. The parser attached all parsed attributes to the output token, permitting HTML event handlers to survive rendering. The patch introduces an allowlist that retains only the execution, flowId, and namespace attributes and discards everything else.

Attack Vector

Exploitation requires an authenticated user with permission to create or update Flow descriptions. The attacker crafts a Flow description containing a malicious [[link]] construct with injected event-handler attributes. The payload is stored server-side and delivered whenever another user views the Flow list description or information panel, satisfying the user-interaction requirement in the CVSS vector.

typescript

// Security patch in ui/src/utils/markdown_plugins/link.ts
const token = state.push("link_custom_open", "link", 1);
token.markup = "[[link]]";
// Before: token.attrs = attrs;
// After: allowlist only known-safe attributes
token.attrs = attrs ? attrs.filter(([name, value]) => ["execution", "flowId", "namespace"].includes(name) && value) : [];
state.push("link_custom_close", "link_custom", -1);

state.pos = state.pos + match[0].length;
// Source: https://github.com/kestra-io/kestra/commit/6c8e6d099ed172cbb6b003b7fb30b7bb1f8f710e

Detection Methods for CVE-2026-55839

Indicators of Compromise

Flow descriptions containing [[link]] tokens with attributes other than execution, flowId, or namespace.
HTML event-handler substrings such as onclick=, onerror=, onmouseover=, or javascript: within stored Flow metadata.
Unexpected outbound requests from browser sessions after users open the Flow list or information panel.

Detection Strategies

Scan the Kestra backing datastore for Flow description fields containing suspicious Markdown link attributes or inline event handlers.
Review audit logs for Flow create and update actions by non-administrative accounts around the disclosure window.
Deploy Content Security Policy (CSP) reporting in browsers accessing Kestra to surface inline script execution attempts.

Monitoring Recommendations

Alert on repeated Flow description edits that include unusual [[link]] syntax variants.
Monitor authenticated Kestra sessions for anomalous API calls originating from browser contexts, indicative of stolen session tokens.
Correlate web proxy telemetry with Kestra UI paths such as /ui/flows to identify script-driven request patterns.

How to Mitigate CVE-2026-55839

Immediate Actions Required

Upgrade all Kestra deployments to version 1.3.24 or later, which enforces the attribute allowlist in the custom Markdown link parser.
Audit existing Flow descriptions for injected event handlers and remove malicious payloads before granting further UI access.
Restrict Flow create and update permissions to trusted users while remediation is in progress.

Patch Information

Kestra fixed the vulnerability in release 1.3.24. The change filters attributes on custom link tokens to a strict allowlist covering execution, flowId, and namespace. Reference the GitHub Security Advisory GHSA-34pm-923j-7wf8, the GitHub Pull Request Update, the GitHub Commit Details, and the GitHub Release v1.3.24 for source-level information.

Workarounds

If immediate patching is not feasible, revoke Flow write permissions from any account that does not strictly require them.
Place Kestra behind a reverse proxy that enforces a strict Content Security Policy disallowing inline event handlers and inline script execution.
Manually sanitize existing Flow descriptions and block persistence of [[link]] syntax containing attributes outside the known-safe set.

bash

# Example: identify Flow records containing suspicious [[link]] attributes
# Adjust the datastore query to match your Kestra backend (JDBC, Elasticsearch, etc.)
grep -REn '\[\[link[^]]*on[a-z]+=' /path/to/kestra/flows/ || \
  echo "No inline event-handler payloads detected in exported flows"

# Upgrade Kestra container to the patched release
docker pull kestra/kestra:v1.3.24
docker stop kestra && docker rm kestra
docker run -d --name kestra kestra/kestra:v1.3.24