CVE-2026-73246: Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kestrato a version that resolves this vulnerability.Fixed in 2.0.0-rc6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73246?
CVE-2026-73246 has a severity rating of high, with a score of 7.5.
What does CVE-2026-73246 expose?
CVE-2026-73246 exposes live task configuration and plaintext credentials through an unauthenticated management endpoint.
How do I fix CVE-2026-73246?
To address CVE-2026-73246, upgrade to Kestra version 2.0.0-rc6 or later.
What kind of information is leaked in CVE-2026-73246?
CVE-2026-73246 can leak sensitive information such as commands, environment variables, and HTTP credentials.
Is authentication required for the /worker endpoint in CVE-2026-73246?
No, the /worker endpoint in CVE-2026-73246 does not require authentication, allowing unauthorized access.