{"id":"GHSA-hpj9-grjp-7vc7","summary":"Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth","details":"## Summary\nKestra's Micronaut **management endpoints are served on port 8081 with no authentication**, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach `:8081` can read `GET /env` (full resolved environment/configuration) and mutate runtime state via `POST /loggers/{name}` (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers `/api/v1/**` on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor's reference `docker-compose.yml` publishes it with no warning.\n \n## Affected\n- Product: Kestra (`kestra-io/kestra`), an open-source orchestration/data-pipeline platform (Java / Micronaut).\n- Version: **v1.3.29** (confirmed); the management-port exposure is an insecure default of the shipped configuration.\n- No fix at time of report.\n## Technical detail\nKestra runs the Micronaut management/actuator endpoints on a separate HTTP port **8081**. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (`/api/v1/**`) and does not apply to 8081. As a result:\n- `GET http://\u003chost\u003e:8081/env` returns the full resolved environment/configuration (property sources), unauthenticated.\n- `POST http://\u003chost\u003e:8081/loggers/{name}` changes a logger's level at runtime, unauthenticated (a state-changing operation).\n- The other Micronaut management endpoints on 8081 are similarly reachable.\nThe shipped `application.yml` comments, `SECURITY.md`, and the vendor's reference `docker-compose.yml` do not warn that 8081 must be kept internal, and the reference compose publishes 8081, so a deployment that enables basic-auth on the API still exposes the management port with no auth.\n \n## Impact\nAn unauthenticated network client that can reach port 8081 can read the full application configuration/environment (`/env`) and change runtime logging (`/loggers`), and reach the other management endpoints — an authentication-bypass on the management surface. (Sensitive credential values in `/env` are masked, so this is scored without a full-secret-read confidentiality impact.)\n \n## Proof of concept\nReproduced live on Kestra v1.3.29 with basic-auth enabled on the main API. Unauthenticated `GET http://\u003chost\u003e:8081/env` returned `200` with the resolved configuration/property sources, and `POST http://\u003chost\u003e:8081/loggers/{name}` returned `200` and changed the logger level — both with no credentials. The equivalent main-API request on 8080 returned `401` (control), confirming the auth filter covers only the API port and not the 8081 management port. (Credential values in `/env` were masked.)\n \nFull request/response captures available on request.\n \n## Remediation\nApply authentication to the management port (bind the Micronaut management endpoints behind the same auth as the API, or require a separate management credential), and by default bind port 8081 to loopback only. At minimum, document prominently (SECURITY.md, application.yml, the reference docker-compose) that port 8081 must never be exposed to untrusted networks, and do not publish 8081 in the reference compose.\n \n## Credit\nReported by **Santosh Kumar Puppala** (GitHub: https://github.com/Santoshkumarpuppala).","aliases":["CVE-2026-73245"],"modified":"2026-09-17T17:30:05.734530669Z","published":"2026-09-17T17:17:55Z","database_specific":{"cwe_ids":["CWE-306"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-17T17:17:55Z","nvd_published_at":"2026-08-11T22:19:05Z"},"references":[{"type":"WEB","url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-hpj9-grjp-7vc7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73245"},{"type":"PACKAGE","url":"https://github.com/kestra-io/kestra"}],"affected":[{"package":{"name":"io.kestra:kestra","ecosystem":"Maven","purl":"pkg:maven/io.kestra/kestra"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.12.0","0.12.1","0.12.2","0.12.3","0.12.4","0.12.5","0.12.6","0.12.7","0.13.0","0.13.1","0.13.10","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.9","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.15.0","0.15.1","0.15.10","0.15.11","0.15.12","0.15.13","0.15.14","0.15.15","0.15.16","0.15.17","0.15.18","0.15.19","0.15.2","0.15.20","0.15.21","0.15.22","0.15.23","0.15.24","0.15.25","0.15.26","0.15.27","0.15.28","0.15.29","0.15.3","0.15.30","0.15.32","0.15.33","0.15.34","0.15.35","0.15.36","0.15.37","0.15.38","0.15.39","0.15.4","0.15.40","0.15.5","0.15.6","0.15.7","0.15.8","0.15.9","0.16.0","0.16.1","0.16.10","0.16.11","0.16.12","0.16.13","0.16.14","0.16.15","0.16.16","0.16.17","0.16.18","0.16.19","0.16.2","0.16.21","0.16.3","0.16.4","0.16.5","0.16.6","0.16.7","0.16.8","0.16.9","0.17.0","0.17.1","0.17.10","0.17.11","0.17.12","0.17.13","0.17.14","0.17.15","0.17.16","0.17.17","0.17.18","0.17.19","0.17.2","0.17.20","0.17.21","0.17.22","0.17.23","0.17.24","0.17.25","0.17.26","0.17.27","0.17.28","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.17.8","0.17.9","0.18.0","0.18.1","0.18.10","0.18.11","0.18.12","0.18.13","0.18.14","0.18.15","0.18.16","0.18.17","0.18.18","0.18.2","0.18.20","0.18.22","0.18.3","0.18.4","0.18.5","0.18.6","0.18.7","0.18.8","0.18.9","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.15","0.19.16","0.19.17","0.19.18","0.19.19","0.19.2","0.19.20","0.19.21","0.19.22","0.19.23","0.19.24","0.19.25","0.19.26","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.2.0","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.15","0.2.16","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.20.0","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.16","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.24","0.20.25","0.20.26","0.20.27","0.20.3","0.20.4","0.20.5","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.1","0.21.10","0.21.11","0.21.12","0.21.13","0.21.14","0.21.15","0.21.16","0.21.17","0.21.18","0.21.19","0.21.2","0.21.20","0.21.3","0.21.4","0.21.5","0.21.6","0.21.7","0.21.8","0.21.9","0.22.0","0.22.1","0.22.10","0.22.11","0.22.12","0.22.13","0.22.14","0.22.15","0.22.16","0.22.17","0.22.18","0.22.19","0.22.2","0.22.20","0.22.21","0.22.22","0.22.23","0.22.24","0.22.25","0.22.26","0.22.27","0.22.28","0.22.29","0.22.3","0.22.30","0.22.31","0.22.32","0.22.33","0.22.34","0.22.35","0.22.36","0.22.37","0.22.38","0.22.39","0.22.4","0.22.40","0.22.41","0.22.42","0.22.44","0.22.45","0.22.46","0.22.5","0.22.6","0.22.7","0.22.8","0.22.9","0.23.0","0.23.1","0.23.10","0.23.11","0.23.12","0.23.13","0.23.14","0.23.15","0.23.16","0.23.17","0.23.18","0.23.19","0.23.2","0.23.20","0.23.21","0.23.22","0.23.23","0.23.24","0.23.25","0.23.26","0.23.27","0.23.28","0.23.29","0.23.3","0.23.30","0.23.31","0.23.32","0.23.33","0.23.5","0.23.6","0.23.7","0.23.8","0.23.9","0.24.0","0.24.1","0.24.10","0.24.11","0.24.12","0.24.13","0.24.14","0.24.15","0.24.16","0.24.17","0.24.18","0.24.19","0.24.2","0.24.20","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.3.0","0.3.1","0.3.2","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5.0","0.5.0-BETA","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.7.1","0.8.0","0.8.1","0.9.0","0.9.1","0.9.2","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.25","1.0.26","1.0.27","1.0.28","1.0.29","1.0.3","1.0.30","1.0.32","1.0.34","1.0.35","1.0.36","1.0.37","1.0.38","1.0.39","1.0.4","1.0.40","1.0.42","1.0.43","1.0.44","1.0.46","1.0.47","1.0.48","1.0.49","1.0.5","1.0.50","1.0.51","1.0.52","1.0.53","1.0.54","1.0.55","1.0.56","1.0.57","1.0.58","1.0.59","1.0.6","1.0.60","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.12","1.1.13","1.1.14","1.1.15","1.1.18","1.1.2","1.1.20","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.14","1.2.15","1.2.16","1.2.17","1.2.18","1.2.19","1.2.2","1.2.21","1.2.22","1.2.23","1.2.24","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.10","1.3.11","1.3.12","1.3.13","1.3.14","1.3.15","1.3.16","1.3.17","1.3.18","1.3.19","1.3.2","1.3.20","1.3.21","1.3.22","1.3.23","1.3.24","1.3.25","1.3.26","1.3.27","1.3.28","1.3.29","1.3.3","1.3.30","1.3.31","1.3.32","1.3.33","1.3.34","1.3.35","1.3.36","1.3.37","1.3.38","1.3.39","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","2.0.0-rc10","2.0.0-rc11","2.0.0-rc12","2.0.0-rc13","2.0.0-rc14","2.0.0-rc15","2.0.0-rc9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hpj9-grjp-7vc7/GHSA-hpj9-grjp-7vc7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}