Kestra, an open‑source orchestration platform, contained an authentication bypass that exposed Micronaut management endpoints on port 8081. The vulnerability allows unauthenticated callers to perform GET /env to retrieve resolved configuration information, potentially including sensitive data, and POST /loggers/{name} to modify log levels at runtime. This flaw is rooted in the missing authentication weakness (CWE‑306) that permits access to privileged internal interfaces without the expected Basic Auth protection in place.

The issue affects Kestra versions before 2.0.0‑rc6. By default, the platform exposes its management endpoints on port 8081, whereas the public API on port 8080 is protected by Basic Auth. Consequently, any user reaching port 8081 can read the environment configuration or change logging without authentication.

With a CVSS score of 6.5 the vulnerability represents moderate severity. The EPSS score of less than 1% indicates that exploit attempts are currently unlikely, and the vulnerability is not listed in CISA's KEV catalog. Attackers who can reach port 8081 remotely would gain read access to configuration data and could alter log levels, potentially aiding other attacks or making detection more difficult. The risk remains contingent on network exposure to the management port.