Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-49869 |
| Alert source | CISA KEV - actively exploited vulnerability |
| CVE year | 2026 |
| Publication date | 2026-09-02 |
| Vendor | Kestra |
| Product | Kestra OSS |
| Fixed versions | 1.0.45 and 1.3.21 |
| CVSS Score | 10.0 (Critical) |
| EPSS Score | 0.99% (60th percentile) |
| CISA KEV | Yes |
| CISA deadline | 2026-09-05 |
| Ransomware | Not confirmed |
Vulnerability Description
Kestra is an open-source, event-driven workflow orchestration platform — used to build and run data pipelines and automate processes.
In versions prior to 1.0.45 and 1.3.21, the AuthenticationFilter class in Kestra OSS
whitelisted the public configuration endpoint from Basic Auth using this condition:
request.getPath().endsWith("/configs")That is the entire vulnerability. endsWith checks the end of the path, not its full
value. As a result, any API address whose last segment reads configs passes straight
by authentication — regardless of what precedes it in the path or which resource it leads to.
Why the impact is code execution rather than configuration disclosure. The bypass is not
limited to one endpoint — it covers the platform’s API. An attacker with no credentials can
create and execute their own workflows. Kestra, meanwhile, ships with script execution
plugins enabled by default — plugin-script-shell, plugin-script-python and related
ones. Running a workflow that executes a shell command is therefore normal, intended use of
the product. For an attacker it means remote execution of arbitrary code as root inside the
worker container, without logging in.
Hence the score of 10.0 — the maximum. There is no precondition here: no credentials, no user interaction, no special configuration. Network access to the API is enough.
This is a textbook authentication logic flaw. There is no buffer overflow and no exotic technique — just one method comparing too little. That is worth noticing, because the same class of bug (an incomplete comparison instead of an exact one) appeared the same week in a completely different product, Visual Studio Code.
The vulnerability is already being exploited — CISA added it to the Known Exploited Vulnerabilities catalog with a deadline of 5 September 2026.
Required Actions
- Update Kestra OSS to 1.0.45 or 1.3.21, depending on the line in use. All earlier releases are vulnerable.
- Check whether the Kestra API is reachable from outside the internal network. If it is, restrict access immediately rather than waiting for an update window. Exploiting this flaw takes a single HTTP request.
- Review the list of defined workflows. Since an attacker could create their own, the review must cover anything that appeared without a request and without an author in the change history. Look for workflows that execute shell commands or fetch external scripts.
- Check the execution history. Runs outside the schedule, at unusual hours, or that cannot be tied to any planned job, are a signal for deeper analysis.
- Rotate secrets available to workers. Kestra workflows typically have access to databases, object stores, source system APIs and cloud keys. Unless the review rules out compromise conclusively, all of those credentials should be treated as potentially exposed.
- Consider disabling script plugins where they are not needed. Shell and Python execution enabled by default is what turns an authentication bypass into full RCE. If your workflows do not use them, disabling them limits the impact of future bugs in this class as well.
Who Is Affected?
The vulnerability affects Kestra OSS deployments on versions earlier than 1.0.45 (the 1.0 line) and 1.3.21 (the 1.3 line).
In practice this means data and platform teams using Kestra as a pipeline orchestration engine — feeding warehouses, running batch processing, integrating systems and automating operational tasks. Such deployments rarely appear in the inventory maintained by the security team, because they are often started by the data team on their own, as a container on shared infrastructure.
This is worth stating separately: the greatest risk with tooling of this kind is that nobody in the organisation knows it is running. If you are not certain whether Kestra is deployed in your environment, finding out is the first step — before updating.
Sources
- NVD - CVE-2026-49869
- CISA Known Exploited Vulnerabilities Catalog
- GitHub Security Advisory GHSA-5vc5-wxxq-3fjx
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
