Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
kestra-io kestra — Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N C H N N 7.7 .0046 38.1 —
AFFECTED
Product Versions Fixed
kestra < 1.0.43 – —
TIMELINE
May 13 Reserved by GitHub_M
Jun 26 EXPLOIT PUBLISHED — CVE-2026-45807 (kestra-io kestra). Public exploit reference added.
Jun 26 Published (CNA: GitHub_M)
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstream code then calls URI.getPath(), which decodes %2E%2E back to .., and the resulting path is handed to Paths.get(...) without normalization. The OS resolves the .. segments at open(2) time, so an authenticated user with a single execution can read any file the Kestra process has access to on the host filesystem (/etc/passwd, mounted secrets, other tenants' execution outputs, etc.). This vulnerability is fixed in 1.0.43 and 1.3.19.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| May 13, 2026 | Reserved | Reserved by GitHub_M |
| June 26, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-45807 (kestra-io kestra). Public exploit reference added. |
| June 26, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| kestra-io | kestra | — | < 1.0.43 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45807 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.