An unauthenticated user can request the /worker endpoint in Kestra releases before 2.0.0-rc6, causing the full live Task object to be returned without authentication. The exposed data includes command parameters, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers, thereby leaking sensitive configuration and secrets. The issue reflects weaknesses in authentication (CWE-306) and information exposure (CWE-200).

The affected product is Kestra (kestra-io:kestra). All deployments running versions older than 2.0.0-rc6 are vulnerable because the WorkerEndpoint.java used in those releases does not protect the GET /worker endpoint. Hosts running such versions expose the worker service to potential readers of the task configuration.

The CVSS base score is 7.5, indicating high severity, while the EPSS score is reported as <1%, showing a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers who can reach the worker’s listening port – either from a publicly exposed network or an internal network if the service is not firewall‑restricted – can exploit the unauthenticated endpoint to retrieve the full task configuration and plaintext credentials. The lack of authentication and the public nature of the endpoint make exploitation straightforward once network access is achieved.