CVE-2026-53577: Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kestrato a version that resolves this vulnerability.Fixed in 1.0.45 - Upgrade
Upgrade
Kestrato a version that resolves this vulnerability.Fixed in 1.3.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53577?
CVE-2026-53577 has a medium severity rating of 6.5.
How do I fix CVE-2026-53577?
To address CVE-2026-53577, upgrade to Kestra version 1.0.45 or 1.3.21 or later.
What type of vulnerability is CVE-2026-53577?
CVE-2026-53577 is an access control bypass vulnerability in the Kestra orchestration platform.
Who is affected by CVE-2026-53577?
Any authenticated user of the Kestra platform prior to version 1.0.45 or 1.3.21 is affected by CVE-2026-53577.
What can happen if CVE-2026-53577 is exploited?
Exploiting CVE-2026-53577 allows an authenticated user to read output files from other executions, potentially exposing sensitive information.