Kestra replaces cloud orchestration like Prefect Cloud with a self-hosted, visual platform running declarative YAML workflows inside your private network.
French engineer Ludovic Dehon built Kestra after managing data operations at retailer Leroy Merlin, where existing workflow engines proved too code-heavy for cross-functional teams. He designed the platform around declarative configurations and an embedded browser editor, allowing engineers and business operators to orchestrate tasks without custom Python code. Today, that foundation gives organizations infrastructure sovereignty by running event-driven workflows entirely inside private networks.
Prefect Cloud relies on a hosted service where pipeline graphs, scheduling metadata, and execution logs stream to vendor servers. While its hybrid agents run locally, the control plane and access permissions remain bound to external infrastructure. Kestra removes that dependency by deploying its complete stack—scheduler, web interface, and execution workers—directly into private Kubernetes clusters, Docker hosts, or air-gapped servers. Sensitive database records and execution parameters never leave internal perimeters.
Choosing Kestra shifts responsibility from subscription fees to infrastructure maintenance. Teams avoid per-user charges, but must manage database persistence and worker resources. Migrating from Prefect Cloud means replacing Python flow decorators with declarative YAML definitions. Teams lose dynamic Python code execution inside DAG definitions, but gain an operational console where non-programmers can trigger and monitor pipelines without installing terminal tools.
Is Kestra free for commercial use? Yes. The core platform carries the Apache-2.0 license with no limits on flow runs, while advanced features like single sign-on require an enterprise subscription.
Kestra vs Prefect Cloud — which should you choose? Choose Prefect Cloud if your engineers write pure Python and want a managed control plane, but pick Kestra if you require on-premise data control and visual workflow management.
Can non-technical team members run workflows without writing code? Yes. Team members can trigger jobs using web input forms, adjust schedules, and monitor live progress directly in the browser.
Kestra is well suited for organizations that value data privacy and want non-developers to run pipelines independently, provided the team can manage its own database and server hosting. Active maintenance with ongoing 2026 commits and an Apache-2.0 license that permits internal deployment without external telemetry make it a dependable self-hosted orchestrator.
We started this exact setup from scratch in a clean Linux machine on Nov 2, 2026 and checked it through Kestra's own API: every check passed. Recipes are re-checked regularly and removed if they stop working.
mkdir -p kestra && cd kestra
curl -fsSL https://open-source.store/tools/kestra/compose.yml -o compose.ymlcat > .env <<EOF
[email protected]
ADMIN_PASSWORD=$(openssl rand -hex 12)
KESTRA_ENCRYPTION_SECRET_KEY=$(openssl rand -base64 32)
KESTRA_URL=http://localhost:8080
POSTGRES_PASSWORD=$(openssl rand -hex 12)
EOFADMIN_EMAIL — Administrator email address used for Kestra web UI and API authentication.ADMIN_PASSWORD — Administrator password for Kestra web UI and API authentication. Generated above; keep it secret.KESTRA_ENCRYPTION_SECRET_KEY — Base64-encoded 32-byte key used to encrypt secrets and sign CSRF tokens. Generated above; keep it secret.KESTRA_URL — Public URL where Kestra is accessed; set to your domain or public IP in production.POSTGRES_PASSWORD — Password for the PostgreSQL database user. Generated above; keep it secret.docker compose up -dservices:
postgres:
image: postgres:16-alpine
volumes:
- postgres-data:/var/lib/postgresql/data
environment:
POSTGRES_DB: kestra
POSTGRES_USER: kestra
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
healthcheck:
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
interval: 5s
timeout: 5s
retries: 5
restart: always
kestra:
image: kestra/kestra:v2.0.8-slim
user: "root"
command: server standalone
volumes:
- kestra-data:/app/storage
- kestra-tmp:/tmp/kestra-wd
environment:
KESTRA_CONFIGURATION: |
datasources:
postgres:
url: jdbc:postgresql://postgres:5432/kestra
driverClassName: org.postgresql.Driver
username: kestra
password: ${POSTGRES_PASSWORD}
kestra:
server:
basic-auth:
username: ${ADMIN_EMAIL}
password: ${ADMIN_PASSWORD}
encryption:
secret-key: ${KESTRA_ENCRYPTION_SECRET_KEY}
repository:
type: postgres
storage:
type: local
local:
base-path: "/app/storage"
queue:
type: postgres
tasks:
tmp-dir:
path: /tmp/kestra-wd/tmp
url: ${KESTRA_URL}
ports:
- "8080:8080"
depends_on:
postgres:
condition: service_healthy
healthcheck:
test: ["CMD-SHELL", "curl -f http://localhost:8081/health || exit 1"]
interval: 10s
timeout: 5s
retries: 15
start_period: 30s
restart: always
volumes:
postgres-data:
kestra-data:
kestra-tmp:
Go, gRPC and Protobuf done right, LLM agents in production, and the hard parts of shipping a first product.
Show that Kestra is listed as an open-source alternative. Paste into your README:
Ubuntu 24.04 · Apple container, Docker 29.1.3, Compose 2.40.3+ds1-0ubuntu1~24.04.1. Images pulled in 150 s: postgres:16-alpine, kestra/kestra:v2.0.8-slim.
Based on the upstream setup. Official compose. Image pinned to v2.0.8-slim: -slim omits pre-bundled plugins (auto-installed on demand) and removing /var/run/docker.sock disables Docker task runners (use the Process task runner instead). Database password, encryption key, and administrator credentials moved to .env; healthchecks added.
kestra-1 | 2026-11-02T01:53:38.569915171Z at io.micronaut.configuration.metrics.binder.netty.ChannelMetricsHandler.channelRead(ChannelMetricsHandler.java:132) kestra-1 | 2026-11-02T01:53:38.569916005Z at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355) kestra-1 | 2026-11-02T01:53:38.569916838Z at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1471) kestra-1 | 2026-11-02T01:53:38.569917671Z at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:960) kestra-1 | 2026-11-02T01:53:38.569918546Z at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:176) kestra-1 | 2026-11-02T01:53:38.569919380Z at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.handle(AbstractNioChannel.java:448) kestra-1 | 2026-11-02T01:53:38.569920380Z at io.netty.channel.nio.NioIoHandler$DefaultNioRegistration.handle(NioIoHandler.java:388) kestra-1 | 2026-11-02T01:53:38.569921296Z at io.netty.channel.nio.NioIoHandler.processSelectedKey(NioIoHandler.java:596) kestra-1 | 2026-11-02T01:53:38.569922088Z at io.netty.channel.nio.NioIoHandler.processSelectedKeysOptimized(NioIoHandler.java:571) kestra-1 | 2026-11-02T01:53:38.569922921Z at io.netty.channel.nio.NioIoHandler.processSelectedKeys(NioIoHandler.java:512) kestra-1 | 2026-11-02T01:53:38.569923755Z at io.netty.channel.nio.NioIoHandler.run(NioIoHandler.java:484) kestra-1 | 2026-11-02T01:53:38.569924546Z at io.netty.channel.SingleThreadIoEventLoop.runIo(SingleThreadIoEventLoop.java:274) kestra-1 | 2026-11-02T01:53:38.569925463Z at io.netty.channel.SingleThreadIoEventLoop.run(SingleThreadIoEventLoop.java:210) kestra-1 | 2026-11-02T01:53:38.569926296Z at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:1214) kestra-1 | 2026-11-02T01:53:38.569928088Z at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) kestra-1 | 2026-11-02T01:53:38.569928921Z at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) kestra-1 | 2026-11-02T01:53:38.569931213Z at java.base/java.lang.Thread.run(Unknown Source) kestra-1 | 2026-11-02T01:53:38.569899796Z 01:53:38.884 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.569Z | GET /sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?windowTitle=AdministratorHelpWindow></TITLE></HEAD><body><script>alert(1337)</script><!--&>helpFile=concepts.html HTTP/1.1 | status: 500 | ip: 192.168.65.249 | length: 281 | duration: 0 kestra-1 | 2026-11-02T01:53:38.570321546Z 01:53:38.287 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.570Z | GET /Admin HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 158 | duration: 0 kestra-1 | 2026-11-02T01:53:38.570352380Z 01:53:38.337 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.570Z | GET /?cffaction=get_data_from_database&query=SELECT%20*%20from%20wp_users HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.570387755Z 01:53:38.367 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.570Z | GET / HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.571349421Z 01:53:38.307 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.571Z | GET /%0d%0aSet-Cookie:crlfinjection=1; HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 186 | duration: 0 kestra-1 | 2026-11-02T01:53:38.571484296Z 01:53:38.456 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.571Z | GET /?cffaction=get_data_from_database&query=SELECT%20*%20from%20wp_users HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.571728296Z 01:53:38.697 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.571Z | GET /OA_HTML/ibeCRgpPartnerPriCreate.jsp HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 188 | duration: 0 kestra-1 | 2026-11-02T01:53:38.571805546Z 01:53:38.783 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.571Z | GET / HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.571920338Z 01:53:38.892 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.571Z | GET /?page=step_1 HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.572032380Z 01:53:38.006 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.571Z | GET /Electron/download/windows/%5Cwindows%5Cwin.ini HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 199 | duration: 0 kestra-1 | 2026-11-02T01:53:38.572185380Z 01:53:38.156 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.572Z | GET /catalog.php?filename=../../../../../../../../../etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 164 | duration: 0 kestra-1 | 2026-11-02T01:53:38.572376880Z 01:53:38.349 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.572Z | GET /OneView/view/center?a%27+type%3d+%27text%27+autofocus+onfocus%3d%27alert(document.domain) HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 172 | duration: 0 kestra-1 | 2026-11-02T01:53:38.572487130Z 01:53:38.450 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.572Z | GET /wp-content/plugins/newsletter/error_log HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 192 | duration: 0 kestra-1 | 2026-11-02T01:53:38.572521505Z 01:53:38.506 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.572Z | GET /doku.php?id=start&do=search&q=the%20%40%3Csvg%2Fonload%3Dalert%60document.domain%60%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 161 | duration: 0 kestra-1 | 2026-11-02T01:53:38.572599421Z 01:53:38.561 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.572Z | GET / HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.572780380Z 01:53:38.748 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.572Z | GET /catalog.php?filename=../../../../../../../../../etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 164 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573580255Z 01:53:38.543 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /index.php?rest_route=/whm/v3/themesettings HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573721046Z 01:53:38.686 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain) HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 190 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573743880Z 01:53:38.729 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /html/device-id HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 167 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573798130Z 01:53:38.776 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /index.php?r=installer/welcome HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573862505Z 01:53:38.834 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /OneView/view/center?a%27+type%3d+%27text%27+autofocus+onfocus%3d%27alert(document.domain) HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 172 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573932213Z 01:53:38.908 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /html/device-id HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 167 | duration: 0 kestra-1 | 2026-11-02T01:53:38.573980755Z 01:53:38.965 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /index.php?option=com_dioneformwizard&controller=../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574066296Z 01:53:38.039 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain) HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 190 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574099505Z 01:53:38.082 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.573Z | GET /resources//../WEB-INF/web.xml HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 182 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574187255Z 01:53:38.167 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.574Z | GET /index.php?r=installer/welcome HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574229713Z 01:53:38.208 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.574Z | GET /ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574265880Z 01:53:38.251 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.574Z | GET /ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574386713Z 01:53:38.349 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.574Z | GET /wp-content/plugins/newsletter/error_log HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 192 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574885005Z 01:53:38.847 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.574Z | GET /index.php?option=com_imagebrowser&folder=../../../../etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:38.574928505Z 01:53:38.912 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.574Z | GET / HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.575118255Z 01:53:38.086 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.575Z | GET /api/fs/read?allowOutsideWorkspace=true&path=/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 164 | duration: 0 kestra-1 | 2026-11-02T01:53:38.575222630Z 01:53:38.179 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.575Z | GET /wp-content/plugins/newsletter/classes/Newsletter/Logs.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 210 | duration: 0 kestra-1 | 2026-11-02T01:53:38.575828296Z 01:53:38.793 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.575Z | GET /setup HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 158 | duration: 0 kestra-1 | 2026-11-02T01:53:38.575963838Z 01:53:38.933 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.575Z | GET /storage/framework/sessions/ HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 180 | duration: 0 kestra-1 | 2026-11-02T01:53:38.576104463Z 01:53:38.078 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:38.576Z | GET / HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:38.576184546Z 01:53:38.160 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:38.576Z | GET /doku.php?id=start&do=search&q=the%20%40%3Csvg%2Fonload%3Dalert%60document.domain%60%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 161 | duration: 0 kestra-1 | 2026-11-02T01:53:39.528008547Z 01:53:39.051 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.525Z | GET /storage/framework/sessions/ HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 180 | duration: 0 kestra-1 | 2026-11-02T01:53:39.528032588Z 01:53:39.394 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.526Z | GET /admin.back%3Cimg%20src=x%20onerror=alert%28document.domain%29%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 217 | duration: 0 kestra-1 | 2026-11-02T01:53:39.528456088Z 01:53:39.371 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.528Z | GET /api/fs/read?allowOutsideWorkspace=true&path=/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 164 | duration: 0 kestra-1 | 2026-11-02T01:53:39.528726922Z 01:53:39.649 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.528Z | GET /?portgw=80089948;%20alert(document.domain) HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:39.529079588Z 01:53:39.020 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.528Z | GET /?page=step_1 HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:39.529404255Z 01:53:39.339 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.529Z | GET /.circleci/ssh-config HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 173 | duration: 0 kestra-1 | 2026-11-02T01:53:39.530028422Z 01:53:39.829 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.529Z | GET / HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:39.531964672Z 01:53:39.461 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.529Z | GET /admin.back%3Cimg%20src=x%20onerror=alert%28document.domain%29%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 217 | duration: 0 kestra-1 | 2026-11-02T01:53:39.531978463Z 01:53:39.626 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.530Z | GET /ajax.php?f=getPipelineJobOrder&joborderID=50&page=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&isPopup=0 HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 161 | duration: 0 kestra-1 | 2026-11-02T01:53:39.531983213Z 01:53:39.945 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.530Z | GET /index.php?option=com_imagebrowser&folder=../../../../etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:39.531986172Z 01:53:39.121 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.530Z | GET /index.php?rest_route=/whm/v3/themesettings HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:39.531989338Z 01:53:39.358 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.531Z | GET /rest/GetUserlogin HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.531992088Z 01:53:39.514 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.531Z | GET /setup HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 158 | duration: 0 kestra-1 | 2026-11-02T01:53:39.531995422Z 01:53:39.657 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.531Z | GET /ajax.php?f=getPipelineJobOrder&joborderID=50&page=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&entriesPerPage=15&sortBy=dateCreatedInt&sortDirection=desc&indexFile=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E&isPopup=0 HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 161 | duration: 0 kestra-1 | 2026-11-02T01:53:39.532272463Z 01:53:39.209 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.530Z | GET /images/json HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 164 | duration: 1 kestra-1 | 2026-11-02T01:53:39.532730255Z 01:53:39.662 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.532Z | GET /storage/sessions/ HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.533016047Z 01:53:39.959 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.532Z | GET /kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 172 | duration: 0 kestra-1 | 2026-11-02T01:53:39.533258755Z 01:53:39.199 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.533Z | GET /rest/GetUserlogin HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.533502630Z 01:53:39.449 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.533Z | GET /service-discovery HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.533755297Z 01:53:39.698 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.533Z | GET /printenv.shtml?%3Cscript%3Ealert(381179906)%3C%2Fscript%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 167 | duration: 0 kestra-1 | 2026-11-02T01:53:39.534095963Z 01:53:39.040 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.533Z | GET /bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain) HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 184 | duration: 0 kestra-1 | 2026-11-02T01:53:39.534301338Z 01:53:39.216 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.531Z | GET /service-discovery HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 2 kestra-1 | 2026-11-02T01:53:39.534558588Z 01:53:39.507 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.534Z | GET /images/json HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 164 | duration: 0 kestra-1 | 2026-11-02T01:53:39.535464463Z 01:53:39.398 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.534Z | GET /theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 308 | duration: 0 kestra-1 | 2026-11-02T01:53:39.535534088Z 01:53:39.726 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.534Z | GET /wp-content/plugins/newsletter/classes/Newsletter/Logs.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 210 | duration: 0 kestra-1 | 2026-11-02T01:53:39.535716463Z 01:53:39.660 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.535Z | GET /?aam-media=wp-config.php HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:39.535948630Z 01:53:39.894 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.535Z | GET /?portgw=80089948;%20alert(document.domain) HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:39.536370422Z 01:53:39.307 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.536Z | GET /theme/META-INF/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 308 | duration: 0 kestra-1 | 2026-11-02T01:53:39.536678755Z 01:53:39.623 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.536Z | GET /opennms/index.jsp HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.536895130Z 01:53:39.827 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.536Z | GET /printenv.shtml?%3Cscript%3Ealert(381179906)%3C%2Fscript%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 167 | duration: 0 kestra-1 | 2026-11-02T01:53:39.537159838Z 01:53:39.103 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.536Z | GET /opennms/index.jsp HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.537370838Z 01:53:39.303 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.536Z | GET /bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=delete.vm&xredirect=javascript:alert(document.domain) HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 184 | duration: 0 kestra-1 | 2026-11-02T01:53:39.537659463Z 01:53:39.607 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.537Z | GET /index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:39.537856630Z 01:53:39.790 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.537Z | GET /index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:39.538180297Z 01:53:39.126 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.537Z | GET /home/000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 181 | duration: 0 kestra-1 | 2026-11-02T01:53:39.538376172Z 01:53:39.310 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.537Z | GET /index.php?option=com_dioneformwizard&controller=../../../../../../../../../../../../../etc/passwd%00 HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 162 | duration: 0 kestra-1 | 2026-11-02T01:53:39.538615922Z 01:53:39.563 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.538Z | GET /home/000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 181 | duration: 0 kestra-1 | 2026-11-02T01:53:39.538935088Z 01:53:39.878 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.538Z | GET /.circleci/ssh-config HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 173 | duration: 0 kestra-1 | 2026-11-02T01:53:39.538981963Z 01:53:39.732 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.538Z | GET /?aam-media=wp-config.php HTTP/1.1 | status: 307 | ip: 192.168.65.249 | length: - | duration: 0 kestra-1 | 2026-11-02T01:53:39.539363297Z 01:53:39.308 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.539Z | GET /rest/GetAutologin HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.539597838Z 01:53:39.531 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.539Z | GET /kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 172 | duration: 0 kestra-1 | 2026-11-02T01:53:39.539856047Z 01:53:39.804 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.539Z | GET /resources//../WEB-INF/web.xml HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 182 | duration: 0 kestra-1 | 2026-11-02T01:53:39.540445088Z 01:53:39.389 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.540Z | GET /rest/GetAutologin HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.540655672Z 01:53:39.223 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.540Z | GET /assets/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 179 | duration: 0 kestra-1 | 2026-11-02T01:53:39.541418630Z 01:53:39.358 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.541Z | GET /storage/sessions/ HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 170 | duration: 0 kestra-1 | 2026-11-02T01:53:39.543244380Z 01:53:39.140 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.542Z | GET /000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 176 | duration: 0 kestra-1 | 2026-11-02T01:53:39.543290297Z 01:53:39.148 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.542Z | GET /opennms/dashboard.jsp HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 174 | duration: 0 kestra-1 | 2026-11-02T01:53:39.543410713Z 01:53:39.379 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.543Z | GET /assets/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 179 | duration: 0 kestra-1 | 2026-11-02T01:53:39.543605922Z 01:53:39.559 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.543Z | GET /000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 176 | duration: 0 kestra-1 | 2026-11-02T01:53:39.544165797Z 01:53:39.103 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.543Z | GET /opennms/dashboard.jsp HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 174 | duration: 0 kestra-1 | 2026-11-02T01:53:39.544282380Z 01:53:39.237 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.544Z | GET /ssi/printenv.shtml?%3Cscript%3Ealert(381179906)%3C%2Fscript%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 171 | duration: 0 kestra-1 | 2026-11-02T01:53:39.544530463Z 01:53:39.492 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.544Z | GET /ssi/printenv.shtml?%3Cscript%3Ealert(381179906)%3C%2Fscript%3E HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 171 | duration: 0 kestra-1 | 2026-11-02T01:53:39.544708088Z 01:53:39.656 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.544Z | GET /theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 294 | duration: 0 kestra-1 | 2026-11-02T01:53:39.545461963Z 01:53:39.400 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.545Z | GET /lib/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 176 | duration: 0 kestra-1 | 2026-11-02T01:53:39.546072255Z 01:53:39.004 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.545Z | GET /theme/META-INF/prototype%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%afwindows/win.ini HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 294 | duration: 0 kestra-1 | 2026-11-02T01:53:39.546406630Z 01:53:39.350 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.546Z | GET /OLDS/home/000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 186 | duration: 0 kestra-1 | 2026-11-02T01:53:39.546607963Z 01:53:39.550 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.546Z | GET /lib/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 176 | duration: 0 kestra-1 | 2026-11-02T01:53:39.546943713Z 01:53:39.890 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.546Z | GET /admin/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 178 | duration: 0 kestra-1 | 2026-11-02T01:53:39.547524672Z 01:53:39.459 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.547Z | GET /admin/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 178 | duration: 0 kestra-1 | 2026-11-02T01:53:39.548827880Z 01:53:39.776 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.546Z | GET /opennms/ HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 161 | duration: 0 kestra-1 | 2026-11-02T01:53:39.549036797Z 01:53:39.992 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.548Z | GET /includes/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 181 | duration: 0 kestra-1 | 2026-11-02T01:53:39.549288338Z 01:53:39.249 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.547Z | GET /app/webroot/files/kcfinder/files/home/000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 214 | duration: 1 kestra-1 | 2026-11-02T01:53:39.549492255Z 01:53:39.445 INFO default-eventLoopGroup-1-1 io.kestra.webserver.access 2026-11-02T01:53:39.549Z | GET /includes/kcfinder/browse.php HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 181 | duration: 0 kestra-1 | 2026-11-02T01:53:39.549520297Z 01:53:39.497 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.549Z | GET /opennms/ HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 161 | duration: 0 kestra-1 | 2026-11-02T01:53:39.549735588Z 01:53:39.689 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.549Z | GET /OLDS/home/000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 186 | duration: 0 kestra-1 | 2026-11-02T01:53:39.552092797Z 01:53:39.015 INFO default-eventLoopGroup-1-2 io.kestra.webserver.access 2026-11-02T01:53:39.551Z | GET /app/webroot/files/kcfinder/files/home/000~ROOT~000/etc/passwd HTTP/1.1 | status: 404 | ip: 192.168.65.249 | length: 214 | duration: 0