Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kestra-io/kestra

              develop @ 85ed6f2
            

154

Fixes

CVEs

CRITICAL

Peak severity

47.5%

Coverage

Highlights

Auth Bypass: 49 prior fixes. Scrutinize any change in this area.

webserver: most-fixed (18 issues). Treat as high-risk during review.

54 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Weak suffix matching and path normalization issues in the AuthenticationFilter let unauthenticated users access protected configurations and execute administrative API endpoints, leading to remote code execution. This is a critical risk highlighted in CVE-2026-49869 and CVE-2026-53576.

Path Traversal: Incomplete path validation and a failure to normalize backslashes before verification in the storage interfaces allowed authenticated users to escape execution directory sandboxes, leading to cross-tenant data leaks and host file access.

SQL Injection: The database query builders in the JDBC and Repository layers have periodically allowed unescaped dynamic parameters to be concatenated into JOOQ queries, creating SQL injection vectors that can lead to remote command execution on database servers.