Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42 Exploit, Mitigation, Vendor Advisory
- https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · kestraNVD modified 2026-10-25 17:10
Affected (CPE criteria) 1
cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*
References 2
- https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42 Exploit, Mitigation, Vendor Advisory
- https://github.com/kestra-io/kestra/security/advisories/GHSA-r6v3-xxwj-9h42 Exploit, Mitigation, Vendor Advisory