Kestra CVE-2026-49869: The Suffix Match That Turned Workflows Into Root Shells

What Changed

Kestra OSS, an open-source event-driven orchestration platform, shipped an authentication bypass in AuthenticationFilter tracked as CVE-2026-49869. The filter intended to whitelist only the public configuration endpoint from Basic Auth. Instead of an exact path match, it used request.getPath().endsWith("/configs"). Any API path whose final segment is literally configs skips authentication.

An unauthenticated attacker can PUT a flow named configs, POST an execution for that flow, and run attacker-controlled commands as root inside the worker container, because Kestra enables the script plugins (plugin-script-shell, plugin-script-python) by default. Fixed versions are 1.0.45 and 1.3.21. CISA added the CVE to KEV on September 2 with a compressed remediation deadline under BOD 26-04.

Why This Matters Operationally

Orchestrators are where credentials, cloud metadata reachability, and “run this script on a schedule” already live. Here the auth bypass leads straight to unauthenticated remote code execution. The bug class is durable: string-suffix allowlists keep failing the same way in API gateways and admin panels. Network exposure is not required for impact; any attacker who can reach port 8080 or 32776 on the Kestra host can exploit default Basic Auth deployments.

What Defenders Should Verify First

• Inventory every Kestra OSS instance and upgrade to 1.0.45 or 1.3.21 (or newer) immediately.
• Hunt for flows named configs, unexpected workflow creates, and executions without matching authenticated users.
• Review worker container logs for shell and Python plugin runs outside change windows.
• If you cannot patch today, put a reverse proxy or WAF in front that enforces authentication on all API paths and allows /configs only as the exact public config route—then still patch.
• Treat internet-exposed Kestra as incident-grade until patched and audited for pre-patch workflow abuse.

Source Context

• GitHub Advisory GHSA-5vc5-wxxq-3fjx
• OSV: CVE-2026-49869
• CISA: Seven KEV additions (Sep 2, 2026)
• CoderCops: Kestra CVSS 10.0 auth bypass analysis

Patch the named releases, then prove nobody named a workflow configs while the suffix check was still freelancing as a VIP badge.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].