CVE-2026-49869 Details
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
An authentication bypass vulnerability has been identified in Kestra OSS versions prior to 1.0.45 and 1.3.21. The issue arises in the AuthenticationFilter, which incorrectly uses a suffix match to whitelist the public configuration endpoint from Basic Auth. This flaw allows any API path ending with 'configs' to bypass authentication, enabling an unauthenticated remote attacker to create and execute arbitrary workflows. Exploitation of this vulnerability leads to unauthenticated remote code execution as root within the Kestra worker container, due to the presence of enabled script execution plugins. Additionally, the vulnerability allows for server-side request forgery against internal network services, including cloud metadata endpoints.
Users can upgrade to Kestra versions 1.0.45 or 1.3.21 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx | CISA-ADP | ExploitVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869 | CISA-ADP | US Government Resource |
| https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx | [email protected] | ExploitVendor Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Kestra OSS OS Command Injection Vulnerability | Sep 2, 2026 | Sep 5, 2026 | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kestra kestra | < 1.0.45 >= 1.1.0, < 1.3.21 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | Modified Analysis | [email protected] |
| Sep 2, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | CVE Modified | [email protected] |
| Jul 1, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |