Kestra is an open-source

CVE-2026-49869 is an authentication bypass chained to OS command injection in Kestra, an open-source event-driven orchestration platform used for data pipelines, ETL, and scheduled workflows. The AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because this is a suffix match rather than an exact path comparison, any API path whose last segment is configs — e.g. /api/v1/main/flows/tutorial/configs — bypasses authentication entirely. Once past auth, an attacker uses the standard Kestra API to PUT a new flow containing a shell or Python task, POST an execution, and retrieve command output from logs. Kestra ships with plugin-script-shell and plugin-script-python enabled by default, so the chain lands unauthenticated RCE as root inside the Kestra worker container with zero clicks. Affected versions: < 1.0.45 and ≥ 1.1.0, < 1.3.21. Fixed in 1.0.45 and 1.3.21.

The vendor score of CVSS 10.0 is honest and, in this case, nearly correct. The vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H accurately reflects the zero-auth, zero-interaction, network-reachable nature of the bug and the changed-scope impact (container → host/network pivot). The only marginal adjustment is that initial RCE lands inside a worker *container*, not directly on the host — but in practice, Kestra workers routinely mount host volumes, hold cloud credentials, and connect to production databases, so the effective blast radius is fleet-scale. Active exploitation is confirmed (KEV added 2026-09-02), a full weaponized PoC with --rce and --ssrf flags is public on GitHub, and CISA's remediation deadline is September 5, 2026 — two days from now. This is as close to a justified 10.0 as you'll see.

Why this verdict

• Unauthenticated RCE with zero friction: The entire chain — auth bypass → flow creation → code execution — requires no credentials, no user interaction, and works against default configurations. The PoC automates it in a single command.
• Public weaponized exploit: The GitHub PoC (Ap0dexMe0/CVE-2026-49869) includes --rce, --ssrf, and --destructive modes. This is not a theoretical advisory — it's a point-and-shoot tool.
• KEV-listed with active exploitation: CISA added this on 2026-09-02 with a 3-day remediation deadline (2026-09-05), confirming real-world attacks. This alone prevents any downgrade.
• Role multiplier: Kestra is a CI/CD and workflow orchestration platform by definition — ≥90% of installs occupy this high-value role. Successful exploitation yields access to pipeline secrets, cloud credentials, production database connections, and downstream supply-chain artifacts. Blast radius: host → cloud tenant → supply chain. The floor is CRITICAL.
• Default-dangerous configuration: Script execution plugins (plugin-script-shell, plugin-script-python) ship enabled by default. Workers run as root. No opt-in required for the attacker to achieve code execution.

Why not higher?

The score is already 9.8 CRITICAL, which is the practical maximum for a single-product vulnerability. The 0.2-point reduction from the vendor's 10.0 reflects that initial code execution lands inside a worker container (not directly on the host kernel), and Kestra's total installed base is smaller than tier-1 CI/CD platforms like Jenkins or GitLab, limiting the global exposure population.

Why not lower?

Every downgrade factor fails here. Auth bypass eliminates the 'requires authentication' friction. Default plugin configuration eliminates 'requires non-default setup'. KEV listing with active exploitation eliminates 'theoretical only'. The CI/CD role multiplier sets a CRITICAL floor that cannot be broken without evidence that <1% of Kestra instances are in production orchestration roles — and by definition, that's what Kestra *is*.

1. Block external access to Kestra API immediately — Place Kestra behind a VPN, zero-trust proxy, or firewall rule that restricts API access (ports 8080/8081) to authorized operator IPs only. This is your noisgate mitigation SLA: deploy within 3 days (but given KEV status, do it today). This neutralizes the unauthenticated remote vector entirely.
2. Deploy WAF rule to block suffix-matched /configs paths — If you cannot patch immediately, add a WAF or reverse proxy rule that rejects any request to /api/v1/*/configs where the path has more than 3 segments. This surgically blocks the bypass without disrupting the legitimate /api/v1/configs endpoint.
3. Remove or disable script execution plugins — If Kestra must remain exposed temporarily, remove plugin-script-shell and plugin-script-python from the plugins directory. This breaks the RCE chain even if auth is bypassed — the attacker can create flows but cannot execute code. Note: this will break legitimate pipelines that use shell/Python tasks.
4. Enforce container network policies — Apply Kubernetes NetworkPolicy or Docker network restrictions to Kestra worker containers, blocking egress to cloud metadata endpoints (169.254.169.254) and limiting lateral movement to only required data sources. This contains blast radius if the worker is compromised.
5. Rotate all secrets accessible to Kestra workers — After patching, rotate cloud credentials, database passwords, API keys, and any secrets stored in Kestra's KV store or injected as environment variables. Assume compromise if you were running an affected version with any internet exposure.

Run this script on any host with curl and network access to the target Kestra instance. Usage: bash check_cve_2026_49869.sh https://kestra.internal:8080. No special privileges required — it performs read-only HTTP requests.

#!/usr/bin/env bash
# CVE-2026-49869 Kestra Auth Bypass Checker
# Usage: bash check_cve_2026_49869.sh <KESTRA_BASE_URL>
# Example: bash check_cve_2026_49869.sh https://kestra.internal:8080
# Requires: curl, jq (optional for version parsing)
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

BASE_URL="${1:?Usage: $0 <KESTRA_BASE_URL>}"
BASE_URL="${BASE_URL%/}"

echo "[*] Checking CVE-2026-49869 against $BASE_URL"

# Step 1: Liveness check
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' "$BASE_URL/api/v1/configs" 2>/dev/null || echo "000")
if [ "$HTTP_CODE" = "000" ]; then
  echo "[!] Cannot reach $BASE_URL — check connectivity"
  echo "UNKNOWN"
  exit 2
fi
echo "[*] Liveness: /api/v1/configs returned HTTP $HTTP_CODE"

# Step 2: Check version if possible
VERSION=$(curl -sk "$BASE_URL/api/v1/configs" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[^"]+' || echo "unknown")
echo "[*] Detected Kestra version: $VERSION"

# Step 3: Confirm auth is enforced on normal endpoint
AUTH_CODE=$(curl -sk -o /dev/null -w '%{http_code}' "$BASE_URL/api/v1/main/flows" 2>/dev/null || echo "000")
echo "[*] Auth baseline: /api/v1/main/flows returned HTTP $AUTH_CODE"

if [ "$AUTH_CODE" = "200" ]; then
  echo "[!] Warning: /api/v1/main/flows returned 200 without auth — auth may be disabled entirely"
  echo "UNKNOWN"
  exit 2
fi

# Step 4: Test bypass paths
BYPASS_PATHS=(
  "/api/v1/main/flows/tutorial/configs"
  "/api/v1/main/executions/tutorial/configs"
  "/api/v1/main/namespaces/tutorial/kv/configs"
  "/api/v1/main/dashboards/configs"
)

VULN=0
for path in "${BYPASS_PATHS[@]}"; do
  CODE=$(curl -sk -o /dev/null -w '%{http_code}' "$BASE_URL$path" 2>/dev/null || echo "000")
  if [ "$CODE" = "200" ]; then
    echo "[!] BYPASS CONFIRMED: $path returned HTTP 200"
    VULN=1
  else
    echo "[*] $path returned HTTP $CODE (blocked)"
  fi
done

if [ "$VULN" -eq 1 ]; then
  echo ""
  echo "VULNERABLE"
  echo "[!] This instance is affected by CVE-2026-49869. Patch to >= 1.0.45 or >= 1.3.21 immediately."
  exit 0
else
  echo ""
  echo "PATCHED"
  echo "[*] Auth bypass paths are blocked. Instance appears patched or mitigated."
  exit 1
fi

Sources

1. NVD - CVE-2026-49869
2. CISA KEV Catalog - September 2 Addition
3. Vulnerability-Lookup - CVE-2026-49869
4. Ap0dexMe0 PoC Exploit - GitHub
5. RedPacket Security - CVE Alert
6. Proofpoint - 2026 Vulnerability Exploitation
7. CISA Known Exploited Vulnerabilities Catalog