Kestra’s API allows a client to supply a kestra:// URI that is later parsed by a storage guard which only examines the raw string representation. If the URI contains a URL‑encoded '..' sequence (e.g., %2E%2E) the guard accepts it but the code later decodes it before converting the path into a file system path. Because the path is passed to the operating system without normalization, the OS resolves the '..' segments at open(2) time, enabling a user that can trigger a single execution to read any file that the Kestra process can access, including system files, secrets, or data belonging to other tenants. The primary impact is confidentiality breach via arbitrary file disclosure.

Kestra, the open‑source event‑driven orchestration platform from kestra‑io, is affected. Versions prior to 1.0.43 and 1.3.19 are vulnerable. The flaw resides in API endpoints that accept kestra:// URIs.

Its CVSS score of 7.7 signals a high‑severity flaw that can lead to confidential data disclosure. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so current exploitation activity is unknown. However, the required conditions are minimal: an authenticated user with execution rights can trigger a single request containing a URL‑encoded traversal sequence. Because the open() call resolves the directory traversal at kernel time, any file accessible to the Kestra process can be exfiltrated. Attackers could therefore read sensitive host files such as /etc/passwd, mounted secrets, or data belonging to other tenants. The lack of an EPSS value does not negate the potential impact, and organizations that host Kestra should treat this as a high risk to confidentiality.