Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.

Affected: Maven: io.kestra:kestra

## Summary Kestra's Micronaut **management endpoints are served on port 8081 with no authentication**, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach `:8081` can read `GET /env` (full resolved environment/configuration) and mutate runtime state via `POST /loggers/{name}` (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers `/api/v1/**` on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor's reference `docker-compose.yml` publishes it with no warning. ## Affected - Product: Kestra (`kestra-io/kestra`), an open-source orchestration/data-pipeline platform (Java / Micronaut). - Version: **v1.3.29** (confirmed); the management-port exposure is an insecure default of the shipped configuration. - No fix at time of report. ## Technical detail Kestra runs the Micronaut management/actuator endpoints on a separate HTTP port **8081**. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (`/api/v1/**`) and does not apply to 8081. As a result: - `GET http://<host>:8081/env` returns the full resolved environment/configuration (property sources), unauthenticated. - `POST http://<host>:8081/loggers/{name}` changes a logger's level at runtime, unauthenticated (a state-changing operation). - The other Micronaut…