CVE-2026-49869

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-49869 10.0

Kestra · Kestra OSS · Added 2026-09-02 · Published 2026-06-26

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityKestra OSS OS Command Injection Vulnerability

VendorKestra

ProductKestra OSS

Date added2026-09-02

Due date2026-09-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-184 CWE-287 CWE-78 CWE-918

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

NVD: Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-02 18:39 UTC

Component defaultyes

Sources https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
https://github.com/Ap0dexMe0/CVE-2026-49869
https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
https://sploitus.com/exploit?id=KITPLOIT%3ATOOLS-GITHUB-AP0DEXME0-CVE-2026-49869
https://cvefeed.io/vuln/detail/CVE-2026-49869

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt Kestra API logs for unauthenticated PUT/POST to paths ending in /configs (e.g. /api/v1/main/flows/tutorial/configs). Alert on io.kestra.plugin.scripts.shell.Commands in request bodies from external IPs.

Research details

ComponentAuthenticationFilter.java endsWith('/configs') suffix-match check

PreconditionsNetwork reachability to Kestra OSS instance (default port 8080); no authentication required; affects versions 1.0.0 through 1.0.44 and 1.3.0 through 1.3.20; Basic Auth must be enabled (default config); script execution plugins (plugin-script-shell, plugin-script-python) must be installed (enabled by default) agent

Public PoCyes

PoC URLs https://github.com/Ap0dexMe0/CVE-2026-49869
https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx Third-party repos; verify before use.

Advisoryhttps://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx

Exploit notesFull weaponized exploit chain documented in vendor advisory and scanner. Attack: PUT a YAML flow to /api/v1/{tenant}/flows/{namespace}/configs (no auth) containing io.kestra.plugin.scripts.shell.Commands, POST to /api/v1/{tenant}/executions/{namespace}/configs to trigger, GET /api/v1/{tenant}/logs/search?executionId= to retrieve output. RCE as uid=0(root) in worker container. Also SSRF via Pebble http() function to cloud metadata endpoints. CVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0)

SummaryCVE-2026-49869 is an authentication bypass in Kestra OSS's AuthenticationFilter that uses a suffix match on endsWith('/configs') instead of an exact path match. This allows unauthenticated access to any API path ending in /configs, enabling flow creation and execution. Because Kestra ships with script execution plugins enabled by default, the attacker achieves unauthenticated RCE as root. Also enables SSRF via the Pebble template engine's http() function. Fixed in versions 1.0.45 and 1.3.21.

Tia coverage

First reported2026-07-29

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-v

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.