Description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T22:19:05.140Z",
  "pubdate": "2026-08-11T22:19:05.140Z",
  "executiveSummary": "An unauthenticated information disclosure and privilege modification vulnerability exists in Kestra prior to version 2.0.0-rc6.\nThe vulnerability involves the exposure of Micronaut management endpoints via port 8081 without authentication mechanisms, bypassing the Basic Auth protection enforced on the primary application endpoints at /api/v1/** on port 8080.\nAttackers can leverage this misconfiguration to execute unauthenticated GET requests to /env, thereby disclosing resolved system configuration details, and execute POST requests to /loggers/{name} to dynamically alter runtime logging levels.\nThe risk implications include potential exposure of sensitive environment variables, secrets, and configuration data, alongside unauthorized manipulation of application behavior via runtime log level modifications.\nExploitation requires network access to port 8081 on the target system, with no prior authentication or administrative privileges required by the threat actor.\nThe vulnerability is fully resolved in Kestra version 2.0.0-rc6 by securing the management endpoints and ensuring proper authentication enforcement.",
  "technicalDetails": "The root cause of the vulnerability stems from misconfigured routing and security scoping within the Micronaut framework implementation inside Kestra.\nSpecifically, the file cli/src/main/resources/application.yml defines the server and management configurations such that Micronaut management endpoints are exposed on a dedicated port 8081.\nWhile the primary API endpoints mapped to /api/v1/** on port 8080 are adequately protected by Basic Auth configurations, the management port 8081 fails to inherit or enforce these equivalent authentication constraints.\nThis creates an unauthenticated security boundary bypass for administrative and diagnostic functionality.\nThe attack flow proceeds with a threat actor targeting port 8081 directly over the network interface exposed by the affected Kestra instance.\nThe attacker sends an unauthenticated HTTP GET request to the /env management endpoint, which responds by disclosing the complete set of resolved configuration properties, environment variables, and potentially sensitive operational parameters.\nFurthermore, the attacker can send an unauthenticated HTTP POST request to /loggers/{name} to alter runtime log levels, which can be utilized for diagnostic tampering or denial-of-service conditions.\nVulnerable components include the Micronaut management server configuration defined in cli/src/main/resources/application.yml across all Kestra versions prior to 2.0.0-rc6.\nThe post-exploitation impact includes the leakage of sensitive internal configurations, database credentials, API keys, or infrastructure secrets present in the environment scope, combined with the capability to manipulate application logging behavior without authorization."
}