shouldiuse.io

Categories

VERDICT

Kestra, Open Source Declarative Orchestration Platform Review

Depends

Should I use Kestra, Open Source Declarative Orchestration Platform?

Use declarative language to build simpler, faster, scalable and flexible workflows - kestra.io

· 1 month ago

Buy if your engineering team needs unified scheduled and event-driven orchestration for data or AI pipelines and can self-host and patch fast. Skip if you need simple automation or can't absorb ongoing security maintenance.

Confidence

Medium. Based on ~20 public sources; official claims dominate and independent user reviews are thin.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Open Source

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
CloudCustom
EnterpriseCustom

Best for

  • Data platform teams
  • AI/ML pipeline orchestration
  • GitOps-driven engineering orgs
  • Teams replacing legacy schedulers

Not for

  • Small teams wanting Zapier-style simple automation
  • Teams without DevOps or Kubernetes capacity
  • Anyone slow to patch — active tenant-isolation CVEs
  • Buyers needing transparent public pricing

Gotchas - check before you buy

high

One recent CVE flagged known-exploited; run 1.3.24+ or isolate the instance.

high

Multi-tenancy storage isolation breach; fixed only in 1.0.45 and 1.3.23.

medium

No public enterprise pricing; expect custom quotes and a sales cycle.

medium

Self-hosting means you own upgrades, backups, and security patching.

Pros and cons

Pros

  • Open source; self-host free on Docker or Kubernetes
  • 26,000+ GitHub stars, strong community traction
  • Declarative YAML with no-code UI for non-engineers
  • Built-in retries, backfills, and failure handling for production
  • Unifies scheduled and event-driven automation in one platform

Cons

  • 11 vulnerabilities in last 90 days; 8 rated high or above
  • Path traversal CVE allowed reading files across tenants
  • Enterprise pricing hidden behind demo calls
  • Only 24 G2 reviews; thin independent feedback

Sources & method

- 12 sources - Multiple recent CVEs including tenant isolation flaws; upgrade to 1.3.24+ before production use.

official x4review x2security x4news x2
  • CVE-2026-55069 — BasicAuth flaw, Vulnerability in BasicAuth authentication affects versions prior to 1.3.24.
  • CVE-2026-49984 — Path traversal, Allows attackers to read sensitive files across tenants.
  • Multi-tenancy isolation breach, Complete breach of storage isolation and multi-tenancy boundary; fixed in 1.0.45 and 1.3.23.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 4/5. Free self-host tier; claims 90% lower legacy tooling cost.
  • Ease of use: 4/5. Declarative YAML plus no-code UI for analysts.
  • Feature depth: 5/5. Scheduled, event-driven, durable execution, multi-tenancy, AI orchestration.
  • Support quality: 3/5. SLA-backed enterprise support offered; quality unverified.
  • Security posture: 2/5. 11 CVEs in 90 days, tenant isolation flaws.
  • 26,000+ GitHub stars Java-based orchestration engine
  • $36M Total funding Last funded March 2026
  • 24 G2 reviews Thin independent review base
  • Yes Free tier Open source, self-hosted

Pricing

Open Source

Free

  • Self-host on Docker or Kubernetes
  • Core orchestration features

Cloud

Not disclosed

  • Managed hosting
  • Pricing not published

Enterprise

Not disclosed

  • SLA-backed support
  • SSO, dedicated customer success

Security

Multiple recent CVEs including tenant isolation flaws; upgrade to 1.3.24+ before production use.

  • CVE-2026-55069 — BasicAuth flawVulnerability in BasicAuth authentication affects versions prior to 1.3.24.⁵
  • CVE-2026-49984 — Path traversalAllows attackers to read sensitive files across tenants.⁶
  • Multi-tenancy isolation breachComplete breach of storage isolation and multi-tenancy boundary; fixed in 1.0.45 and 1.3.23.⁷

What users say

Independent reviews are thin — 24 G2 reviews — but Reddit and GitHub community sentiment is positive.

“the existing orchestration tools are either too technical”
Reddit, r/opensource

Alternatives

Compare Kestra, Open Source Declarative Orchestration Platform with each alternative.

Full analysis

Based on ~20 public sources; official claims dominate and independent user reviews are thin.

Powerful open-source orchestrator for engineers; recent tenant-isolation CVEs and self-host burden make it overkill for simple automation.

Methodology

Based on ~20 public sources; official claims dominate and independent user reviews are thin.

Read how a report is made.

Sources

  1. Kestra official sitekestra.io
    official
  2. Kestra GitHub repositorygithub.com
    official
  3. Kestra pricing pagekestra.io
    official
  4. Kestra enterprise/ self-host pagego.kestra.io
    official
  5. NVD — CVE-2026-55069nvd.nist.gov
    security
  6. SentinelOne — CVE-2026-49984sentinelone.com
    security
  7. OpenCVE — Kestra vendor CVEsopencve.alliance.unm.edu
    security
  8. CyStack — kestra-io vulnerability databasecystack.net
    security
  9. G2 — kestra reviewsg2.com
    review
  10. Reddit r/opensource — Kestra launch threadreddit.com
    review
  11. DevTune — Kestra research dossierdevtune.ai
    news
  12. Edward — Kestra company profileedwardco.app
    news

Add this review to your site

This check for Kestra, Open Source Declarative Orchestration Platform says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Kestra, Open Source Declarative Orchestration Platform Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.