CVE-2026-49984 | kestra-io kestra up to 1.0.44/1.3.22 Local internal-storage Backend /api/v1 path traversal (GHSA-qw4v-6w32-xx9h)

June 27, 2026 Yanac

A vulnerability was found in kestra-io kestra up to 1.0.44/1.3.22 and classified as critical. This affects an unknown function of the file /api/v1 of the component Local internal-storage Backend. The manipulation results in path traversal.

This vulnerability was named CVE-2026-49984. The attack may be performed from remote. There is no available exploit.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More