GHSA-hpj9-grjp-7vc7

Suggest an improvement
Source
https://github.com/advisories/GHSA-hpj9-grjp-7vc7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hpj9-grjp-7vc7/GHSA-hpj9-grjp-7vc7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hpj9-grjp-7vc7
Aliases
Published
2026-09-17T17:17:55Z
Modified
2026-09-17T17:30:05Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth
Details

Summary

Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API (port 8080) has basic-auth enabled. Anyone who can reach :8081 can read GET /env (full resolved environment/configuration) and mutate runtime state via POST /loggers/{name} (change log levels), among the other management endpoints. Enabling basic-auth creates a false sense of protection because the auth filter only covers /api/v1/** on 8080 and never applies to the 8081 management port. The shipped repository contains no statement that 8081 is management-only / must-not-be-exposed, and the vendor's reference docker-compose.yml publishes it with no warning.

Affected

  • Product: Kestra (kestra-io/kestra), an open-source orchestration/data-pipeline platform (Java / Micronaut).
  • Version: v1.3.29 (confirmed); the management-port exposure is an insecure default of the shipped configuration.
  • No fix at time of report.

Technical detail

Kestra runs the Micronaut management/actuator endpoints on a separate HTTP port 8081. The authentication filter (basic-auth, when configured) is scoped to the main API on port 8080 (/api/v1/**) and does not apply to 8081. As a result:

  • GET http://<host>:8081/env returns the full resolved environment/configuration (property sources), unauthenticated.
  • POST http://<host>:8081/loggers/{name} changes a logger's level at runtime, unauthenticated (a state-changing operation).
  • The other Micronaut management endpoints on 8081 are similarly reachable. The shipped application.yml comments, SECURITY.md, and the vendor's reference docker-compose.yml do not warn that 8081 must be kept internal, and the reference compose publishes 8081, so a deployment that enables basic-auth on the API still exposes the management port with no auth.

Impact

An unauthenticated network client that can reach port 8081 can read the full application configuration/environment (/env) and change runtime logging (/loggers), and reach the other management endpoints — an authentication-bypass on the management surface. (Sensitive credential values in /env are masked, so this is scored without a full-secret-read confidentiality impact.)

Proof of concept

Reproduced live on Kestra v1.3.29 with basic-auth enabled on the main API. Unauthenticated GET http://<host>:8081/env returned 200 with the resolved configuration/property sources, and POST http://<host>:8081/loggers/{name} returned 200 and changed the logger level — both with no credentials. The equivalent main-API request on 8080 returned 401 (control), confirming the auth filter covers only the API port and not the 8081 management port. (Credential values in /env were masked.)

Full request/response captures available on request.

Remediation

Apply authentication to the management port (bind the Micronaut management endpoints behind the same auth as the API, or require a separate management credential), and by default bind port 8081 to loopback only. At minimum, document prominently (SECURITY.md, application.yml, the reference docker-compose) that port 8081 must never be exposed to untrusted networks, and do not publish 8081 in the reference compose.

Credit

Reported by Santosh Kumar Puppala (GitHub: https://github.com/Santoshkumarpuppala).

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:17:55Z",
    "nvd_published_at": "2026-08-11T22:19:05Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / io.kestra:kestra

Package

Name
io.kestra:kestra
View open source insights on deps.dev
Purl
pkg:maven/io.kestra/kestra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.0

Affected versions

0.*
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.5.0-BETA
0.5.0
0.5.1
0.5.2
0.5.3
0.6.0
0.7.0
0.7.1
0.8.0
0.8.1
0.9.0
0.9.1
0.9.2
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.12.2
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.13.5
0.13.6
0.13.7
0.13.8
0.13.9
0.13.10
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9
0.15.10
0.15.11
0.15.12
0.15.13
0.15.14
0.15.15
0.15.16
0.15.17
0.15.18
0.15.19
0.15.20
0.15.21
0.15.22
0.15.23
0.15.24
0.15.25
0.15.26
0.15.27
0.15.28
0.15.29
0.15.30
0.15.32
0.15.33
0.15.34
0.15.35
0.15.36
0.15.37
0.15.38
0.15.39
0.15.40
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.16.8
0.16.9
0.16.10
0.16.11
0.16.12
0.16.13
0.16.14
0.16.15
0.16.16
0.16.17
0.16.18
0.16.19
0.16.21
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.17.8
0.17.9
0.17.10
0.17.11
0.17.12
0.17.13
0.17.14
0.17.15
0.17.16
0.17.17
0.17.18
0.17.19
0.17.20
0.17.21
0.17.22
0.17.23
0.17.24
0.17.25
0.17.26
0.17.27
0.17.28
0.18.0
0.18.1
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.18.8
0.18.9
0.18.10
0.18.11
0.18.12
0.18.13
0.18.14
0.18.15
0.18.16
0.18.17
0.18.18
0.18.20
0.18.22
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
0.19.10
0.19.11
0.19.12
0.19.13
0.19.14
0.19.15
0.19.16
0.19.17
0.19.18
0.19.19
0.19.20
0.19.21
0.19.22
0.19.23
0.19.24
0.19.25
0.19.26
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.20.5
0.20.6
0.20.7
0.20.8
0.20.9
0.20.10
0.20.11
0.20.12
0.20.13
0.20.14
0.20.15
0.20.16
0.20.17
0.20.18
0.20.19
0.20.20
0.20.21
0.20.22
0.20.23
0.20.24
0.20.25
0.20.26
0.20.27
0.21.0
0.21.1
0.21.2
0.21.3
0.21.4
0.21.5
0.21.6
0.21.7
0.21.8
0.21.9
0.21.10
0.21.11
0.21.12
0.21.13
0.21.14
0.21.15
0.21.16
0.21.17
0.21.18
0.21.19
0.21.20
0.22.0
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.22.8
0.22.9
0.22.10
0.22.11
0.22.12
0.22.13
0.22.14
0.22.15
0.22.16
0.22.17
0.22.18
0.22.19
0.22.20
0.22.21
0.22.22
0.22.23
0.22.24
0.22.25
0.22.26
0.22.27
0.22.28
0.22.29
0.22.30
0.22.31
0.22.32
0.22.33
0.22.34
0.22.35
0.22.36
0.22.37
0.22.38
0.22.39
0.22.40
0.22.41
0.22.42
0.22.44
0.22.45
0.22.46
0.23.0
0.23.1
0.23.2
0.23.3
0.23.5
0.23.6
0.23.7
0.23.8
0.23.9
0.23.10
0.23.11
0.23.12
0.23.13
0.23.14
0.23.15
0.23.16
0.23.17
0.23.18
0.23.19
0.23.20
0.23.21
0.23.22
0.23.23
0.23.24
0.23.25
0.23.26
0.23.27
0.23.28
0.23.29
0.23.30
0.23.31
0.23.32
0.23.33
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
0.24.7
0.24.8
0.24.9
0.24.10
0.24.11
0.24.12
0.24.13
0.24.14
0.24.15
0.24.16
0.24.17
0.24.18
0.24.19
0.24.20
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.0.18
1.0.19
1.0.20
1.0.21
1.0.22
1.0.23
1.0.24
1.0.25
1.0.26
1.0.27
1.0.28
1.0.29
1.0.30
1.0.32
1.0.34
1.0.35
1.0.36
1.0.37
1.0.38
1.0.39
1.0.40
1.0.42
1.0.43
1.0.44
1.0.46
1.0.47
1.0.48
1.0.49
1.0.50
1.0.51
1.0.52
1.0.53
1.0.54
1.0.55
1.0.56
1.0.57
1.0.58
1.0.59
1.0.60
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.1.12
1.1.13
1.1.14
1.1.15
1.1.18
1.1.20
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.17
1.2.18
1.2.19
1.2.21
1.2.22
1.2.23
1.2.24
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.3.17
1.3.18
1.3.19
1.3.20
1.3.21
1.3.22
1.3.23
1.3.24
1.3.25
1.3.26
1.3.27
1.3.28
1.3.29
1.3.30
1.3.31
1.3.32
1.3.33
1.3.34
1.3.35
1.3.36
1.3.37
1.3.38
1.3.39
2.*
2.0.0-rc9
2.0.0-rc10
2.0.0-rc11
2.0.0-rc12
2.0.0-rc13
2.0.0-rc14
2.0.0-rc15

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hpj9-grjp-7vc7/GHSA-hpj9-grjp-7vc7.json"