CVE-2026-73246: Kestra Information Disclosure Flaw

CVE-2026-73246 Overview

CVE-2026-73246 is an information disclosure vulnerability in Kestra, an open-source event-driven orchestration platform. Versions prior to 2.0.0-rc6 expose the worker endpoint at GET /worker without authentication. The endpoint serializes the complete live Task object, revealing commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers. The main API on port 8080 remains protected, but the worker endpoint bypasses these controls. The vulnerability is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. Kestra released version 2.0.0-rc6 to remediate the issue.

Critical Impact
Unauthenticated network attackers can retrieve plaintext credentials, environment variables, and execution context from any exposed Kestra worker, enabling downstream compromise of connected systems.

Affected Products

Kestra orchestration platform, all versions prior to 2.0.0-rc6
Deployments exposing the worker component on a reachable network interface
Self-hosted Kestra clusters where the worker port is not firewalled from untrusted networks

Discovery Timeline

2026-08-11 - CVE-2026-73246 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73246

Vulnerability Analysis

The vulnerability resides in the Kestra worker component at worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java. The endpoint responds to unauthenticated GET /worker requests by serializing the live Task object being processed by the worker. Because the Task object holds the full execution context, the serialized response includes shell commands, environment variables, HTTP request headers, database connection strings, plaintext secrets injected into tasks, and internal execution identifiers.

Authentication enforced on the main Kestra API listening on port 8080 does not apply to the worker endpoint. An attacker with network reach to the worker interface receives sensitive data without credentials or user interaction. Disclosed credentials can be replayed against external systems that the worker connects to, extending the impact beyond Kestra itself.

Root Cause

The worker endpoint was implemented without an authentication filter or access control check. The Micronaut route handler serializes the in-memory Task object directly to the HTTP response, and no field-level redaction is applied to secret-bearing properties.

Attack Vector

Exploitation requires only network access to the worker port. An attacker issues an HTTP GET request to /worker and parses the JSON response for credentials, command lines, and environment variables. The vulnerability is remotely exploitable, requires no privileges, and needs no user interaction. Refer to the Kestra GitHub Security Advisory GHSA-m65f-q5gj-hg46 for the vendor description.

Detection Methods for CVE-2026-73246

Indicators of Compromise

Unexpected HTTP GET requests to the /worker path in Kestra worker access logs
Requests to the worker endpoint originating from IP addresses outside the orchestration cluster
Sudden use of Kestra-managed service credentials from unfamiliar source addresses in downstream systems

Detection Strategies

Review reverse proxy and load balancer logs for any external client reaching worker component ports
Alert on HTTP 200 responses to /worker requests where the source IP is not an allow-listed administrative host
Correlate Kestra credential usage timestamps with anomalous authentication events in connected databases, cloud APIs, and SaaS integrations

Monitoring Recommendations

Enable request logging on the Kestra worker component and forward logs to a centralized SIEM
Rotate credentials referenced in Kestra flows and monitor for use of legacy secrets after rotation
Baseline outbound connections from workers to identify replay of exposed connection strings against unexpected endpoints

How to Mitigate CVE-2026-73246

Immediate Actions Required

Upgrade Kestra to version 2.0.0-rc6 or later, which removes the unauthenticated worker exposure
Block external network access to the worker component port at the firewall or ingress controller
Rotate every credential, API token, and connection string that has been referenced by tasks running on affected workers
Audit worker access logs for prior unauthenticated GET /worker requests to determine whether disclosure has occurred

Patch Information

The fix is included in Kestra 2.0.0-rc6. Upgrade instructions and the full advisory are documented in the Kestra GitHub Security Advisory GHSA-m65f-q5gj-hg46.

Workarounds

Restrict worker component network exposure to the internal orchestration subnet using host firewalls or Kubernetes NetworkPolicies
Place an authenticating reverse proxy in front of the worker endpoint if upgrading immediately is not feasible
Remove plaintext secrets from task definitions and reference a secrets manager so that any future disclosure yields references rather than credentials

bash

# Example Kubernetes NetworkPolicy restricting access to Kestra worker pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kestra-worker-restrict
  namespace: kestra
spec:
  podSelector:
    matchLabels:
      app: kestra-worker
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: kestra-executor
        - namespaceSelector:
            matchLabels:
              name: kestra