GHSA-HPJ9-GRJP-7VC7
Vulnerability from github – Published: 2026-09-17 17:17 – Updated: 2026-09-17 17:17Summary
Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach :8081 can read GET /env (full resolved environment/configuration) and mutate runtime state via POST /loggers/{name} (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers /api/v1/** on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor's reference docker-compose.yml publishes it with no warning.
Affected
- Product: Kestra (
kestra-io/kestra), an open-source orchestration/data-pipeline platform (Java / Micronaut). - Version: v1.3.29 (confirmed); the management-port exposure is an insecure default of the shipped configuration.
- No fix at time of report.
Technical detail
Kestra runs the Micronaut management/actuator endpoints on a separate HTTP port 8081. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (/api/v1/**) and does not apply to 8081. As a result:
- GET http://<host>:8081/env returns the full resolved environment/configuration (property sources), unauthenticated.
- POST http://<host>:8081/loggers/{name} changes a logger's level at runtime, unauthenticated (a state-changing operation).
- The other Micronaut management endpoints on 8081 are similarly reachable.
The shipped application.yml comments, SECURITY.md, and the vendor's reference docker-compose.yml do not warn that 8081 must be kept internal, and the reference compose publishes 8081, so a deployment that enables basic-auth on the API still exposes the management port with no auth.
Impact
An unauthenticated network client that can reach port 8081 can read the full application configuration/environment (/env) and change runtime logging (/loggers), and reach the other management endpoints — an authentication-bypass on the management surface. (Sensitive credential values in /env are masked, so this is scored without a full-secret-read confidentiality impact.)
Proof of concept
Reproduced live on Kestra v1.3.29 with basic-auth enabled on the main API. Unauthenticated GET http://<host>:8081/env returned 200 with the resolved configuration/property sources, and POST http://<host>:8081/loggers/{name} returned 200 and changed the logger level — both with no credentials. The equivalent main-API request on 8080 returned 401 (control), confirming the auth filter covers only the API port and not the 8081 management port. (Credential values in /env were masked.)
Full request/response captures available on request.
Remediation
Apply authentication to the management port (bind the Micronaut management endpoints behind the same auth as the API, or require a separate management credential), and by default bind port 8081 to loopback only. At minimum, document prominently (SECURITY.md, application.yml, the reference docker-compose) that port 8081 must never be exposed to untrusted networks, and do not publish 8081 in the reference compose.
Credit
Reported by Santosh Kumar Puppala (GitHub: https://github.com/Santoshkumarpuppala).
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.kestra:kestra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73245"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T17:17:55Z",
"nvd_published_at": "2026-08-11T22:19:05Z",
"severity": "MODERATE"
},
"details": "## Summary\nKestra\u0027s Micronaut **management endpoints are served on port 8081 with no authentication**, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach `:8081` can read `GET /env` (full resolved environment/configuration) and mutate runtime state via `POST /loggers/{name}` (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers `/api/v1/**` on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor\u0027s reference `docker-compose.yml` publishes it with no warning.\n \n## Affected\n- Product: Kestra (`kestra-io/kestra`), an open-source orchestration/data-pipeline platform (Java / Micronaut).\n- Version: **v1.3.29** (confirmed); the management-port exposure is an insecure default of the shipped configuration.\n- No fix at time of report.\n## Technical detail\nKestra runs the Micronaut management/actuator endpoints on a separate HTTP port **8081**. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (`/api/v1/**`) and does not apply to 8081. As a result:\n- `GET http://\u003chost\u003e:8081/env` returns the full resolved environment/configuration (property sources), unauthenticated.\n- `POST http://\u003chost\u003e:8081/loggers/{name}` changes a logger\u0027s level at runtime, unauthenticated (a state-changing operation).\n- The other Micronaut management endpoints on 8081 are similarly reachable.\nThe shipped `application.yml` comments, `SECURITY.md`, and the vendor\u0027s reference `docker-compose.yml` do not warn that 8081 must be kept internal, and the reference compose publishes 8081, so a deployment that enables basic-auth on the API still exposes the management port with no auth.\n \n## Impact\nAn unauthenticated network client that can reach port 8081 can read the full application configuration/environment (`/env`) and change runtime logging (`/loggers`), and reach the other management endpoints \u2014 an authentication-bypass on the management surface. (Sensitive credential values in `/env` are masked, so this is scored without a full-secret-read confidentiality impact.)\n \n## Proof of concept\nReproduced live on Kestra v1.3.29 with basic-auth enabled on the main API. Unauthenticated `GET http://\u003chost\u003e:8081/env` returned `200` with the resolved configuration/property sources, and `POST http://\u003chost\u003e:8081/loggers/{name}` returned `200` and changed the logger level \u2014 both with no credentials. The equivalent main-API request on 8080 returned `401` (control), confirming the auth filter covers only the API port and not the 8081 management port. (Credential values in `/env` were masked.)\n \nFull request/response captures available on request.\n \n## Remediation\nApply authentication to the management port (bind the Micronaut management endpoints behind the same auth as the API, or require a separate management credential), and by default bind port 8081 to loopback only. At minimum, document prominently (SECURITY.md, application.yml, the reference docker-compose) that port 8081 must never be exposed to untrusted networks, and do not publish 8081 in the reference compose.\n \n## Credit\nReported by **Santosh Kumar Puppala** (GitHub: https://github.com/Santoshkumarpuppala).",
"id": "GHSA-hpj9-grjp-7vc7",
"modified": "2026-09-17T17:17:55Z",
"published": "2026-09-17T17:17:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73245"
},
{
"type": "PACKAGE",
"url": "https://github.com/kestra-io/kestra"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.