CVE-2026-73245: Kestra Auth Bypass Vulnerability

CVE-2026-73245 Overview

CVE-2026-73245 affects Kestra, an open-source, event-driven orchestration platform. Versions prior to 2.0.0-rc6 expose Micronaut management endpoints on port 8081 without authentication, even when Basic Auth protects /api/v1/** on port 8080. Attackers can send unauthenticated GET /env requests to disclose resolved configuration values and POST /loggers/{name} requests to modify runtime log levels. The issue stems from the default configuration in cli/src/main/resources/application.yml. The flaw is classified as [CWE-306] Missing Authentication for Critical Function and is fixed in Kestra 2.0.0-rc6.

Critical Impact
Unauthenticated network attackers can read resolved application configuration, potentially exposing secrets, and can alter runtime logging behavior on affected Kestra deployments.

Affected Products

Kestra versions prior to 2.0.0-rc6
Deployments exposing the Micronaut management port 8081
Configurations using the default cli/src/main/resources/application.yml

Discovery Timeline

2026-08-11 - CVE-2026-73245 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73245

Vulnerability Analysis

Kestra runs on the Micronaut framework, which exposes optional management endpoints for observability and operational control. In vulnerable releases, the shipped application.yml binds these endpoints to port 8081 without applying the Basic Auth filter that protects the API surface on port 8080.

Two endpoints carry the most risk. The GET /env endpoint returns the resolved Micronaut environment, including property sources that may contain database credentials, API tokens, and other secrets. The POST /loggers/{name} endpoint accepts log level changes at runtime, allowing an attacker to enable verbose or debug logging on arbitrary loggers.

Root Cause

The root cause is a configuration defect [CWE-306]. Authentication was applied selectively to /api/v1/** on the primary HTTP port but was not extended to the separate management port. As a result, network-reachable clients can query management endpoints without credentials.

Attack Vector

Exploitation requires only network access to port 8081 on a Kestra host. An unauthenticated attacker issues an HTTP GET request to /env to enumerate configuration, then issues an HTTP POST to /loggers/{name} with a JSON payload specifying a new log level. Successful requests do not require user interaction and do not modify persistent state beyond runtime logger configuration.

No proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-hpj9-grjp-7vc7 for vendor technical details.

Detection Methods for CVE-2026-73245

Indicators of Compromise

Unauthenticated HTTP requests to /env, /loggers, or other Micronaut management endpoints on port 8081.
Unexpected runtime changes to logger levels, particularly loggers switched to DEBUG or TRACE.
Access log entries showing external source addresses reaching port 8081.

Detection Strategies

Inspect HTTP access logs for GET /env and POST /loggers/* requests from sources outside trusted management networks.
Alert on any 2xx response to management endpoints where the source IP is not on an allowlist.
Monitor Micronaut logger configuration changes correlated to inbound requests on the management port.

Monitoring Recommendations

Forward Kestra application and access logs to a centralized SIEM for query and correlation.
Baseline expected callers of port 8081 and generate alerts on new source addresses.
Track outbound egress from Kestra hosts for signs of exfiltration following configuration disclosure.

How to Mitigate CVE-2026-73245

Immediate Actions Required

Upgrade Kestra to 2.0.0-rc6 or later, which applies authentication to the management endpoints.
Block external network access to port 8081 using host firewalls, security groups, or Kubernetes NetworkPolicies.
Rotate any credentials, tokens, or secrets that may have been exposed through /env responses.

Patch Information

The vendor released a fix in Kestra 2.0.0-rc6. Details are available in the Kestra GitHub Security Advisory GHSA-hpj9-grjp-7vc7. Upgrading is the recommended remediation path.

Workarounds

Restrict port 8081 to loopback or a dedicated management subnet via firewall rules.
Disable unused Micronaut endpoints such as env and loggers in application.yml where operational tooling does not require them.
Place Kestra behind a reverse proxy that enforces authentication on all exposed ports, not just 8080.

bash

# Configuration example: disable sensitive management endpoints
# in application.yml, then restart Kestra
endpoints:
  env:
    enabled: false
  loggers:
    enabled: false
  all:
    port: -1  # bind management endpoints to disabled port