Login Request a demo
KE
Product
Kestra
by Kestra · last CVE Jun 26, 2026
On CISA KEVExploited in the wild
10
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities10In the news2Timeline
Severity mix
Critical 4High 3Medium 3Low 0
Severity
All severities10Critical4High3Medium3Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Kestra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49869
In wildKEV
10.0
2%
Jun 26
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
Affected: before 1.0.45; 1.1.0 before 1.3.21
CVE-2026-53576
10.0
3%
Jun 26
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
Affected: before 1.0.45; 1.1.0 before 1.3.21
CVE-2026-38428
9.8
0%
May 5
Kestra v1.3.3 and before is vulnerable to SQL Injection
Affected: before 1.0.35; 1.1.0 before 1.3.7
CVE-2026-34612
9.0
1%
Apr 3
Kestra: Remote Code Execution via SQL Injection
Affected: before 1.3.7
Showing 4