CVE-2026-49869

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

Exploited in the wild. In CISA KEV since 2026‑09‑02. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile81st2.1% chance in 30 days CISA KEVListedsince 2026-09-02, due 2026-09-05
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-26Updated 2026-09-03Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Kestra is reachable from the internet and whether it runs a Kestra version prior to 1.0.45 (or prior to 1.3.21).
Confirm whether an attacker could reach the AuthenticationFilter endpoint behavior by verifying your deployed Kestra version and environment exposure (default configs endpoint whitelist is affected when requests target paths ending in “/configs”).
Upgrade Kestra to a fixed version: install kestra 1.0.45 or later (or upgrade to 1.3.21 or later).
If you cannot patch immediately, block network access to your Kestra instance from the public internet and ensure only trusted IPs can reach it, then continue with the upgrade.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

In plain language

Written by AI from the record

CVE-2026-49869 is a critical Kestra security flaw where attackers can skip login by using a URL that ends with “/configs”, letting them create and run scripts as the highest-privilege user—so any small business running the vulnerable Kestra versions should act immediately.

Kestra AuthenticationFilter performs an unsafe URL whitelist check using a suffix match (e.g., paths ending in “/configs”) that bypasses authentication, enabling unauthenticated Remote Code Execution to create and execute workflows as root on reachable instances; this is listed in CISA KEV (added 2026-09-02) with a mitigation deadline of 2026-09-05.

If you're affected

Full system takeover via scripts
Malicious workflows executed
Sensitive data exposure
Service outage and disruption

What is it

Kestra helps automate workflows. This bug is like a door that only checks the “last words” in a URL; an attacker can use a specially crafted URL to walk right past the login check. Once inside, they can create and run scripts as the most powerful user, turning your automation platform into a way to run arbitrary commands on your infrastructure.

Who is affected

This matters if you run Kestra and your instance is reachable over the network (especially from the internet). It’s not blocked by login, because the bypass applies when the request URL ends with “/configs”. Exposure is tied to whether your Kestra is reachable in its default configuration and can be accessed by an attacker on the network.

How urgent is it

This is RED urgency because this issue is confirmed in CISA KEV and has a very short remediation window. Attackers can bypass authentication without credentials by crafting a URL that ends in “/configs”, then execute code as root on reachable Kestra instances.

What to do — in detail

1) Confirm exposure

Identify your deployed Kestra version.
- If it is older than the fix versions, you are affected (fixed in 1.0.45; also fixed in 1.3.21).
Verify whether the Kestra web/API is reachable from the internet.
- The findings state this is reachable in default configuration, so internet exposure is the key gate.
Ensure you understand network reachability to the vulnerable URL behavior.
- The bypass is triggered by requests to paths ending in “/configs”. If your Kestra is publicly accessible, treat the bypass path as reachable.

2) Remediate (primary fix)

Upgrade Kestra to a fixed version:
- Upgrade to 1.0.45 or later, or
- Upgrade to 1.3.21 or later.
After upgrade, validate Kestra health and that typical authentication-protected endpoints behave normally.

3) If patching is delayed (temporary containment)

Restrict network access so attackers can’t reach the Kestra instance.
- Block public internet access to Kestra.
- Allow access only from trusted networks/IPs (e.g., your office/VPN/administration IPs).
Continue working toward upgrading to the fixed version.

4) Forensics/monitoring after mitigation

Look for unusual workflow/script creation activity around the time of exposure.
Review Kestra logs for requests whose paths end with “/configs”.
Check for newly created or modified workflows and any executions that don’t match your normal change patterns.

5) CISA timing

CISA KEV remediation due date: 2026-09-05.

Technical context

CVE-2026-49869 is a critical authentication-bypass leading to unauthenticated Remote Code Execution in Kestra via the AuthenticationFilter’s incorrect URL handling.

Weaknesses: CWE-78 (OS command/injection class), CWE-184 (unused/incorrect checks), CWE-287 (improper authentication logic), CWE-918 (server-side request forgery class is not implied here; the KEYS are authentication bypass and code execution).
Mechanism: The AuthenticationFilter incorrectly skips security checks for “too many URLs” by using a suffix match rather than a strict path match. Specifically, it whitelists requests where the path ends with “/configs”, allowing an unauthenticated attacker to reach functionality used to create/run configuration-driven workflows.
Privilege impact: The findings state this allows attackers to create and run scripts as the root user.
Reachability: The vulnerability is network-exploitable without authentication and without user interaction, and is reachable in default configuration when the Kestra instance is accessible.
Exploitation status: Listed in CISA KEV (added 2026-09-02). The KEV program indicates confirmed real-world risk; treat this as an active remediation case.
Patch: Fixed in 1.0.45 (and also 1.3.21 per the provided backstop).
Public exploit code: none recorded in the provided findings.
EPSS: provided as a prediction only and not used as a basis for urgency given the KEV status.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS81st

CISA KEV

Listed as exploited in the wild since 2026-09-02.

US federal agencies must remediate by 2026-09-05.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

2.1% chance of exploitation activity in the next 30 days, which ranks it in the 81st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

16 events over 78 days, from the signal feeds we watch.

2026-09-12OpenVAS check added
2026-09-11Analysis publishedKestra's Login Bypass Was One Line of Code. Attackers Mined Crypto With It for Two Months Before CISA Noticed.
2026-09-03Patch availablerecord updated
2026-09-02Added to CISA KEVpatch available, patch available, patch available, record updated, record updated, record updated
2026-07-01Patch availablerecord updated
2026-06-26Publishedweakness classified, att&ck mapped

Affected products

kestra-iooss-project
- kestraOn-premDevTools & CI / ci-cd
kestraoss-project
- kestraMixedDevTools & CI / ci-cd

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable