Kestra OSS’s authentication filter exempted one configuration endpoint from Basic Auth by checking whether the request path ended in /configs, rather than matching the exact intended routes. Any API route whose final segment was configs could therefore skip authentication. The Kestra project’s GitHub security advisory, published June 3, 2026, rates the issue Critical with a CVSS v3.1 base score of 10.0, lists versions through 1.3.20 as affected, and names 1.0.45 and 1.3.21 as patched.
How a suffix check turned into an authentication exemption
According to the advisory, the OSS AuthenticationFilter used request.getPath().endsWith("/configs") to decide which requests could bypass Basic Auth. The endpoints the project intended to leave public were GET /api/v1/configs and GET /api/v1/{tenant}/configs. A suffix test cannot distinguish those two routes from any other path that happens to end in the same word.
As an Amazon Associate I earn from qualifying purchases.
| Request path | Intended to be public | Matched by the suffix check |
|---|---|---|
GET /api/v1/configs |
Yes | Yes |
GET /api/v1/{tenant}/configs |
Yes | Yes |
Any other API route whose last path segment is configs |
No | Yes; the advisory says these routes also bypassed authentication |
The underlying mistake is a common one. The filter makes its authentication decision from the raw URL string before the application has resolved which handler will serve the request. When an allowlist is expressed as a string pattern, every route that shares the pattern inherits the exemption, including routes added later. Exact-match rules tied to the full route, or an explicit list of permitted method-and-path pairs, keep the exemption limited to what was intended.
What the advisory says an unauthenticated caller could do
The advisory’s impact section describes several consequences. They are the vendor’s description of the flaw in its described setup; the advisory does not present them as results reproduced across every deployment.
#1 Best Overall
Unauthenticated workflow creation and execution
The central consequence is that a remote attacker without credentials can create and run a workflow named configs. The advisory states: “An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials.”
Command execution inside the worker container
The advisory says Kestra’s script execution plugins, installed by default in the described setup, could then run commands as root inside the worker container. The advisory is specific about the boundary: it describes execution in the worker container and states that a direct Docker-socket escape was not confirmed. A worker-container root context should not be read as proof of host root or a container escape.
Server-side request forgery against internal services
The advisory also describes server-side request forgery, meaning the Kestra server or workers could be made to send requests to internal services that the attacker cannot reach directly.
Unauthorized operations on resources named configs
Finally, the advisory mentions unauthorized operations involving resources named configs, beyond the workflow case.
Which deployments the advisory covers
- Product: Kestra OSS, running with Basic Auth. The advisory identifies this as the affected configuration, described as
micronaut.security.enabled=false. - Versions: releases through 1.3.20 are listed as affected.
- Network position: public internet exposure is not required. The advisory says an attacker who can reach the Kestra service port is sufficient.
- Proof of concept: the advisory states its proof of concept was tested against Kestra OSS v1.3.20.
Fixed releases
| Release state | Version named in the advisory | What to do |
|---|---|---|
| Affected | Through 1.3.20 | Verify the deployed version, then upgrade |
| Patched | 1.0.45 | Use this fixed release if you run the 1.0 line |
| Patched | 1.3.21 | Use this fixed release if you run the 1.3 line |
Because the advisory was published in June 2026, confirm the current supported release branch and any later patch releases in the Kestra release notes before choosing an upgrade target.
What to verify on your deployment
- Confirm the running version. Check the image tag or release package your deployment actually pulls. A configuration file that names a version does not prove what is running.
- Check the authentication mode. Determine whether Kestra OSS runs with Basic Auth and whether
micronaut.security.enabledis set tofalsein the environment or configuration files that the running process reads. - Map network reachability. Include container networks, internal VPN users, load balancers, and CI runners that can reach the service port. Internet exposure is not the only condition the advisory names.
- Upgrade to the fixed release on your branch. Apply the release named for your line, or a later release that supersedes it.
- Review workflows and requests. Look for workflows named
configsthat you did not create, unexpected executions, and requests to paths ending in/configsfrom sources you do not recognize. Review logs from the period when the service was reachable and running an affected version. - Review worker plugins. Consider removing script execution plugins that your workflows do not need, since the advisory’s command-execution impact depends on them.
What the evidence does and does not establish
- The severity rating and score are the vendor’s own assessment, as published in the advisory. No independent scoring or prevalence study is cited for this issue.
- The described impacts come from the advisory’s description. The source does not establish host compromise or a container escape.
- The advisory’s proof of concept is reported as tested against v1.3.20. Behaviour on other affected versions is not separately described in the advisory.
The Kestra project’s advisory is the primary source for this article. Check it directly for the current wording of affected and patched versions, since patch and support status can change after publication.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
