CVE-2026-55839: Panel stored XSS — HIGH

Q: Is CVE-2026-55839 actively exploited?

No confirmed active exploitation of CVE-2026-55839 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55839?

Upgrade Kestra to 1.3.24 or later, which fixes the Markdown link parser to strip injected event-handler attributes. Until patched, restrict Flow create/update permissions to trusted users only and enable code review or approval workflows for flow description changes. Deploy or verify a strict Content-Security-Policy on the Kestra web UI to limit inline script execution as defense-in-depth. Audit existing flow descriptions for suspicious `[[link]]` syntax containing `on*=` event handlers, and monitor for anomalous admin-session activity following flow-list views.

Q: What systems are affected by CVE-2026-55839?

This vulnerability affects the following AI/ML architecture patterns: MLOps/pipeline orchestration platforms, training pipelines, CI/CD pipelines for AI workflows.

Q: What is the CVSS score for CVE-2026-55839?

CVE-2026-55839 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.43%.

CISO Take

Kestra's custom Markdown parser fails to sanitize its `[[link]]` shorthand, letting anyone with permission to edit a Flow's description embed JavaScript event-handler attributes that execute when another user simply opens that flow in the Flow list or its info panel. With a CVSS of 8.7 and a Changed scope (S:C), the payload runs in the victim's browser session rather than the attacker's, meaning a low-privileged flow editor can pivot into whatever access a higher-privileged operator or admin holds — session hijacking, credential theft, or unauthorized pipeline actions inside an orchestration platform with 499 downstream dependents. There's no CISA KEV listing, no public exploit, and no Nuclei template yet, so this isn't under active mass exploitation, but the low attack complexity and lack of required special privileges beyond basic flow-edit rights make it a realistic insider or compromised-account risk. Patch to Kestra 1.3.24, which fixes the parser in `ui/src/utils/markdown_plugins/link.ts`; until then, restrict flow-creation/edit permissions and treat any unusual link syntax in flow descriptions as suspicious during review.

Sources:NVDGitHub AdvisoryOpenSSFATLAS

What is the risk?

High severity (CVSS 8.7) driven by a Changed scope and high confidentiality/integrity impact combined with low attack complexity — the only friction is that the attacker needs low-level privileges to edit a flow description and a victim must open the affected UI panel. Because Kestra orchestrates automated pipelines, the realistic blast radius includes operators and admins who routinely browse the Flow list, making the required user interaction highly likely in normal workflows. No active exploitation or public tooling has been observed, but the vulnerability class (stored XSS in a widely-deployed orchestration UI) is well understood and trivial to weaponize once an attacker has any flow-edit access.

How does the attack unfold?

Initial Access

Attacker obtains or already holds low-privilege Kestra access sufficient to create or update a Flow description.

AML.T0049

Payload Injection

Attacker crafts a malicious [[link]] entry in the flow description embedding a JavaScript event-handler attribute, exploiting the unsanitized custom Markdown parser.

Victim Trigger

A higher-privileged user opens the Flow list or the flow's info panel, causing the browser to render and execute the injected script.

AML.T0011

Impact

The stored XSS executes in the victim's authenticated session, enabling session/token theft or unauthorized actions against the AI pipeline orchestration platform.

Initial Access

Attacker obtains or already holds low-privilege Kestra access sufficient to create or update a Flow description.

AML.T0049

Payload Injection

Attacker crafts a malicious [[link]] entry in the flow description embedding a JavaScript event-handler attribute, exploiting the unsanitized custom Markdown parser.

Victim Trigger

A higher-privileged user opens the Flow list or the flow's info panel, causing the browser to render and execute the injected script.

AML.T0011

Impact

The stored XSS executes in the victim's authenticated session, enabling session/token theft or unauthorized actions against the AI pipeline orchestration platform.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	maven	< 1.3.24	`1.3.24`
5.8KOpenSSF 6.5514 dependentsPushed yesterday67% patched~15d to patchFull package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

Upgrade Kestra to 1.3.24 or later, which fixes the Markdown link parser to strip injected event-handler attributes. Until patched, restrict Flow create/update permissions to trusted users only and enable code review or approval workflows for flow description changes. Deploy or verify a strict Content-Security-Policy on the Kestra web UI to limit inline script execution as defense-in-depth. Audit existing flow descriptions for suspicious [[link]] syntax containing on*= event handlers, and monitor for anomalous admin-session activity following flow-list views.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageFrameworkAML.T0011- User Execution AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2-System security for AI systems and supporting infrastructure

NIST AI RMF

MANAGE 4.1-Risk management of third-party AI system components

Frequently Asked Questions

What is CVE-2026-55839?

Kestra's custom Markdown parser fails to sanitize its `[[link]]` shorthand, letting anyone with permission to edit a Flow's description embed JavaScript event-handler attributes that execute when another user simply opens that flow in the Flow list or its info panel. With a CVSS of 8.7 and a Changed scope (S:C), the payload runs in the victim's browser session rather than the attacker's, meaning a low-privileged flow editor can pivot into whatever access a higher-privileged operator or admin holds — session hijacking, credential theft, or unauthorized pipeline actions inside an orchestration platform with 499 downstream dependents. There's no CISA KEV listing, no public exploit, and no Nuclei template yet, so this isn't under active mass exploitation, but the low attack complexity and lack of required special privileges beyond basic flow-edit rights make it a realistic insider or compromised-account risk. Patch to Kestra 1.3.24, which fixes the parser in `ui/src/utils/markdown_plugins/link.ts`; until then, restrict flow-creation/edit permissions and treat any unusual link syntax in flow descriptions as suspicious during review.

Is CVE-2026-55839 actively exploited?

No confirmed active exploitation of CVE-2026-55839 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55839?

Upgrade Kestra to 1.3.24 or later, which fixes the Markdown link parser to strip injected event-handler attributes. Until patched, restrict Flow create/update permissions to trusted users only and enable code review or approval workflows for flow description changes. Deploy or verify a strict Content-Security-Policy on the Kestra web UI to limit inline script execution as defense-in-depth. Audit existing flow descriptions for suspicious `[[link]]` syntax containing `on*=` event handlers, and monitor for anomalous admin-session activity following flow-list views.

What systems are affected by CVE-2026-55839?

This vulnerability affects the following AI/ML architecture patterns: MLOps/pipeline orchestration platforms, training pipelines, CI/CD pipelines for AI workflows.

What is the CVSS score for CVE-2026-55839?

CVE-2026-55839 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

MLOps/pipeline orchestration platformstraining pipelinesCI/CD pipelines for AI workflows

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.

Exploitation Scenario

An attacker with low-level access to Kestra (e.g., a compromised developer account or a malicious contractor with flow-edit rights) crafts a flow description using the custom `[[link]]` syntax, embedding a JavaScript event-handler attribute (e.g., `onerror`/`onclick`) that exfiltrates cookies or auth tokens to an attacker-controlled endpoint. The attacker saves the flow and waits. When an admin or higher-privileged operator opens the Flow list or clicks into the flow's info panel to review pipeline status, the browser renders the unsanitized Markdown and executes the injected script in the victim's authenticated session, giving the attacker the victim's session credentials or the ability to perform actions (e.g., modifying other pipelines) as that higher-privileged user.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.