CVE-2026-53576: Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass

Synopsis

This is an authentication bypass leading to unauthenticated remote code execution in Kestra, the open-source event-driven workflow orchestration platform. The vulnerability is reachable over the network with no credentials required and no victim interaction needed: an attacker crafts a URL whose final path segment is the literal string 'configs', which tricks the authentication filter into skipping the credential check entirely. A successful attacker creates an arbitrary workflow containing a Shell or Process task, triggers its execution as root inside the Kestra container, and because the official Docker Compose setup mounts the Docker socket, the attacker gains full control of the underlying host. Fix versions 1.0.45 and 1.3.21 have been published; a patched-image rebuild is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Kestra REST API over the network; no local or physical access is needed.

• AuthenticationNot required

  No credentials are needed; the path-suffix filter bypass forwards the request before any credential check occurs.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator of the target system.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the attacker simply appends the literal segment 'configs' to a targeted API path, making the exploit reliable and repeatable.

Blast Radius

• The attacker executes arbitrary shell commands as root inside the Kestra container, giving full read and write access to all files, secrets, and environment variables in that container.
• Because the official Docker Compose setup mounts /var/run/docker.sock, root in the container reaches the host Docker daemon and can launch, inspect, or destroy any container on the host.
• The attacker reads all workflow definitions, stored credentials, and namespace key-value secrets managed by the Kestra instance.
• The attacker modifies or deletes existing workflows and execution history, disrupting all scheduled and event-driven orchestration running on the platform.