CVE-2026-49869: Kestra OSS auth bypass via path suffix match enables RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass leading to root remote code execution, with confirmed KEV listing and a CVSS score of 10.

What it is

Kestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exact path match. Any API path ending in "configs" therefore skips Basic Auth entirely, letting an unauthenticated attacker create and execute arbitrary workflows. With script execution plugins enabled by default, this escalates to remote code execution as root in the Kestra worker container.

Impact

An unauthenticated remote attacker gains full workflow creation and execution, which yields arbitrary command execution as root inside the Kestra worker container. This compromises the orchestration platform and any credentials or data reachable from that container.

Attack surface

Reachable over the network via HTTP against the Kestra API; no authentication is required because the flawed suffix check bypasses Basic Auth, and no user interaction is needed. The CVSS vector confirms AV:N/AC:L/PR:N/UI:N.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a 2026-09-05 due date, and the vendor advisory is tagged Exploit, indicating active exploitation. EPSS is modest at 0.01917 (78.8th percentile), so KEV status is the stronger signal.

What to do

• Upgrade Kestra to 1.0.45 or 1.3.21 (or later) immediately; this is the only complete fix.
• If patching cannot be done at once, block or restrict external access to the Kestra API and UI, especially any path ending in "configs".
• Disable or remove script execution plugins (plugin-script-shell, plugin-script-python, and similar) where they are not operationally required.
• Run Kestra workers with a non-root user and least-privilege container settings to limit post-exploitation impact.
• Follow CISA BOD 26-04 guidance, including evaluating internet exposure and applying the required mitigations by the due date.

Detection

• Audit Kestra API access logs for unauthenticated requests to paths whose final segment is "configs", particularly non-standard paths.
• Monitor for new or modified workflows and unexpected flow executions, especially those invoking shell or python script tasks.
• Alert on child processes spawned by the Kestra worker container, such as shells or interpreters launched from workflow execution.
• Review worker container activity for privilege escalation or outbound connections consistent with post-exploitation behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.