kestra-io — Vulnerabilities & Security Advisories 4

Kestra-io is an open-source workflow automation platform designed for orchestrating complex data pipelines and infrastructure tasks. Historically, it has been susceptible to remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, with four CVEs documented to date. The platform's security posture is characterized by its containerized execution environment, which helps contain potential impacts. While no major public security incidents have been reported, the presence of RCE vulnerabilities in past versions highlights the importance of timely updates and proper input validation in workflow definitions.