CVE-2026-53577

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation. This vulnerability is fixed in 1.0.45 and 1.3.21.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-535786.1Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter CVE-2026-535796.1Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter CVE-2026-535808.1Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts f CVE-2026-535819.0OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core,CVE-2026-535827.1OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate CVE-2026-535836.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535844.3libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535855.3libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535866.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535877.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535918.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can CVE-2026-535924.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` fu