Kestra vs Node-RED

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Node-RED

Node-RED's Admin HTTP API covers flows, nodes and settings in 20 documented methods, with read and write permissions per resource and a revision check on deploys. It has no OpenAPI file, no pagination and no SDK, and a default install accepts API calls from anyone who can reach port 1880.

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth

Node-RED

1. Call GET /auth/login first. An empty object means no authentication is set and every Admin API call is open
2. Send Node-RED-API-Version: v2 and the last rev on POST /flows, and re-read the flows on a 409
3. Set Node-RED-Deployment-Type to nodes or flows to restart only what changed. The default full stops every node
4. Prefer GET /flow/:id and PUT /flow/:id for one tab. GET /flows returns every node in the runtime
5. Treat flows.write and nodes.write as code execution on the host. Function nodes run JavaScript and POST /nodes installs npm modules