https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:27:11 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-73245 <p>Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra&#39;s cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.</p> <p>Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra&#39;s cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.</p> https://db.gcve.eu/vuln/fkie_cve-2026-73245 https://db.gcve.eu/vuln/ghsa-hpj9-grjp-7vc7 <p><strong>Affected:</strong> Maven: io.kestra:kestra</p> <p>## Summary Kestra&#39;s Micronaut **management endpoints are served on port 8081 with no authentication**, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach `:8081` can read `GET /env` (full resolved environment/configuration) and mutate runtime state via `POST /loggers/{name}` (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers `/api/v1/**` on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor&#39;s reference `docker-compose.yml` publishes it with no warning. ## Affected - Product: Kestra (`kestra-io/kestra`), an open-source orchestration/data-pipeline platform (Java / Micronaut). - Version: **v1.3.29** (confirmed); the management-port exposure is an insecure default of the shipped configuration. - No fix at time of report. ## Technical detail Kestra runs the Micronaut management/actuator endpoints on a separate HTTP port **8081**. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (`/api/v1/**`) and does not apply to 8081. As a result: - `GET http://&lt;host&gt;:8081/env` returns the full resolved environment/configuration (property sources), unauthenticated. - `POST http://&lt;host&gt;:8081/loggers/{name}` changes a logger&#39;s level at runtime, unauthenticated (a state-changing operation). - The other Micronaut…</p> <p><strong>Affected:</strong> Maven: io.kestra:kestra</p> <p>## Summary Kestra&#39;s Micronaut **management endpoints are served on port 8081 with no authentication**, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach `:8081` can read `GET /env` (full resolved environment/configuration) and mutate runtime state via `POST /loggers/{name}` (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers `/api/v1/**` on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor&#39;s reference `docker-compose.yml` publishes it with no warning. ## Affected - Product: Kestra (`kestra-io/kestra`), an open-source orchestration/data-pipeline platform (Java / Micronaut). - Version: **v1.3.29** (confirmed); the management-port exposure is an insecure default of the shipped configuration. - No fix at time of report. ## Technical detail Kestra runs the Micronaut management/actuator endpoints on a separate HTTP port **8081**. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (`/api/v1/**`) and does not apply to 8081. As a result: - `GET http://&lt;host&gt;:8081/env` returns the full resolved environment/configuration (property sources), unauthenticated. - `POST http://&lt;host&gt;:8081/loggers/{name}` changes a logger&#39;s level at runtime, unauthenticated (a state-changing operation). - The other Micronaut…</p> https://db.gcve.eu/vuln/ghsa-hpj9-grjp-7vc7