A suffix-matching flaw in Kestra OSS's authentication filter lets unauthenticated remote attackers create and execute arbitrary workflows, code execution that, in common default deployments, runs with root privileges, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02.
What Is It
Kestra is an open-source, event-driven orchestration platform. In versions prior to 1.0.45 and 1.3.21, the AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because that check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely.
An unauthenticated remote attacker can leverage that bypass to create and execute arbitrary workflows without credentials. Since Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, and others) enabled by default, this chains directly into unauthenticated remote code execution inside the Kestra worker container. The privilege level of that execution depends on how the deployment is configured: where the worker container runs as root, the attacker gets root-level RCE. Environments that run workers as a non-root user, in a hardened container runtime, or with script plugins removed still face arbitrary code execution, but with correspondingly reduced privilege. Operators should verify the effective user and capabilities of their worker containers rather than assume either outcome.
CISA tracks it as "Kestra OSS OS Command Injection Vulnerability." Assigned weaknesses: CWE-78, CWE-184, CWE-287, and CWE-918.
Why It Matters
The CVSS v3.1 base score is 10.0 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Network attack vector, low complexity, no privileges, no user interaction, changed scope, and total impact across confidentiality, integrity, and availability.
CISA's SSVC assessment marks exploitation as active, automatable yes, and technical impact total. KEV inclusion confirms this is being exploited in the wild. Known ransomware campaign use is listed as Unknown. The KEV entry flags forensic triage as required.
What's Vulnerable
- Kestra (kestra-io/kestra) versions < 1.0.45
- Kestra versions >= 1.1.0, < 1.3.21
CISA notes the vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products; so downstream exposure may extend past direct Kestra deployments.
Patch Status
Fixed in 1.0.45 and 1.3.21.
CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines.
Due date: 2026-09-05: three days after KEV addition.
Sources
- Kestra Security Advisory GHSA-5vc5-wxxq-3fjx; https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869
- NVD, CVE-2026-49869, https://nvd.nist.gov/vuln/detail/CVE-2026-49869
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance (Forensics Triage Requirements), https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk