CVE-2026-49984 Path traversal in kestra
Authenticated users can read arbitrary server files, including secrets and other tenants' data, via a path traversal vulnerability in the file download API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49984?
CVE-2026-49984 is a high-severity path traversal vulnerability in kestra-io kestra, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past the guard using backslashes (..\..\..\); the guard sees a harmless string, and the path is only rewritten to ../../../ after validation, immediately before the file is opened. Any authenticated user who can view an execution (the lowest-privilege role) can call GET /api/v1/{tenant}/executions/{executionId}/file?path=… and read any file on the server filesystem readable by the Kestra process, outside the storage sandbox and across every tenant and namespace. This includes the embedded H2 database (all flows, all users, all stored secrets), internal storage of every other tenant/namespace, mounted secret files, and the process environment (/proc/self/environ) which contains configured database and secret-backend credentials. It is a complete breach of Kestra's storage isolation and multi-tenancy boundary. This vulnerability is fixed in 1.0.45 and 1.3.23.
Which versions are affected by CVE-2026-49984?
It affects 1 product.
Products include Kestra Kestra.
How do I fix CVE-2026-49984?
No fix has been published for CVE-2026-49984 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49984 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49984 exists.
Other vulnerabilities in kestra-io kestra
- CVE-2026-49869 Kestra OSS OS Command Injection
- CVE-2026-53576 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
- CVE-2026-34612 Kestra: Remote Code Execution via SQL Injection
- CVE-2026-38428 SQL injection in n/a
- CVE-2026-55069 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack
Sources
Also known as GHSA-qw4v-6w32-xx9h.