Kestra

Kestra <= 1.3.20 - Remote Code Execution

Kestra <= 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint.