What Changed
Kestra OSS, an open-source event-driven orchestration platform, shipped an authentication bypass in AuthenticationFilter tracked as CVE-2026-49869. The filter intended to whitelist only the public configuration endpoint from Basic Auth. Instead of an exact path match, it used request.getPath().endsWith("/configs"). Any API path whose final segment is literally configs skips authentication.
An unauthenticated attacker can PUT a flow named configs, POST an execution for that flow, and—because Kestra enables script plugins (plugin-script-shell, plugin-script-python) by default—run attacker-controlled commands as root inside the worker container. Fixed versions are 1.0.45 and 1.3.21. CISA added the CVE to KEV on September 2 with a compressed remediation deadline under BOD 26-04.
Why This Matters Operationally
Orchestrators are where credentials, cloud metadata reachability, and “run this script on a schedule” already live. An auth bypass here is not a dashboard squiggle—it is unauthenticated remote code execution on the automation plane. The bug class is durable: string-suffix allowlists keep failing the same way in API gateways and admin panels. Network exposure is not required for impact; any attacker who can reach port 8080 or 32776 on the Kestra host can exploit default Basic Auth deployments.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. 5 minutes or less.
Built from 100+ trusted cybersecurity sources.
What Defenders Should Verify First
- Inventory every Kestra OSS instance and upgrade to 1.0.45 or 1.3.21 (or newer) immediately.
- Hunt for flows named
configs, unexpected workflow creates, and executions without matching authenticated users. - Review worker container logs for shell and Python plugin runs outside change windows.
- If you cannot patch today, put a reverse proxy or WAF in front that enforces authentication on all API paths and allows
/configsonly as the exact public config route—then still patch. - Treat internet-exposed Kestra as incident-grade until patched and audited for pre-patch workflow abuse.
Source Context
- GitHub Advisory GHSA-5vc5-wxxq-3fjx
- OSV: CVE-2026-49869
- CISA: Seven KEV additions (Sep 2, 2026)
- CoderCops: Kestra CVSS 10.0 auth bypass analysis
Patch the named releases, then prove nobody named a workflow configs while the suffix check was still freelancing as a VIP badge.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
