The automation platform Kestra is affected by a maximum-severity flaw: CVE-2026-49869 carries the top CVSS score of 10.0 and lets unauthenticated attackers run arbitrary commands as root. The U.S. agency CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026.
A suffix check defeats the login
According to the vendor advisory GHSA-5vc5-wxxq-3fjx, the root cause is a logic error in the „AuthenticationFilter“. It was meant only to exempt the public /configs endpoint from Basic Auth, but it checks the request with endsWith("/configs") instead of an exact path match. As a result, any API path whose final segment ends in „/configs“ bypasses authentication entirely.
Because Kestra ships with script-execution plugins enabled by default, the bypass leads straight to unauthenticated code execution as root inside the worker container. Attackers can create and launch their own workflows, reach internal services via SSRF, harvest cloud metadata at 169.254.169.254, and wipe audit logs.
Affected versions and patches
- Vulnerable: all Kestra releases up to and including 1.3.20
- Fixed in: 1.0.45 and 1.3.21
- The io.kestra editions are affected
According to The Hacker News, security researchers observed attacks as early as late June 2026 that used the flaw to spawn a reverse shell, enumerate the Docker environment, and install a cryptocurrency miner. U.S. federal agencies face a remediation deadline; all other operators should update to a patched release at once and take exposed instances off the public internet.
Sources: Kestra Security Advisory (GHSA) · CISA KEV · The Hacker News
