K
Vendor security profile1 actively exploited CVEs
kestra-io
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs5
Critical1
CISA KEV1
Public exploit4
Patch rate%40
Avg. CVSS8.3
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
4
0
0
CVE KEV
CVE severity distribution
5toplam CVE
Critical1 (20%)
High3 (60%)
Medium1 (20%)
Patch and exploitation view
%40
Verified patch
%20
CISA KEV
%80
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
8.7
CVE-2026-55839
Kestra: Stored XSS via custom Markdown [[link]] attribute injection
K
Patch verifiedEPSS %0
8.6
CVE-2026-73247
Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
K
Patch status unknownEPSS %0
7.5
CVE-2026-73246
Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
K
Patch status unknownEPSS %1
6.5
CVE-2026-73245
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
K
Patch verifiedEPSS %0
10.0
CVE-2026-49869 Actively exploited
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
K
Patch status unknownEPSS %2