CVE-2026-49869: Kestra’s CVSS 10.0 RCE Is on CISA’s KEV List

CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on September 2, 2026. The vulnerability — a CVSS 10.0 authentication bypass in Kestra OSS — lets an unauthenticated attacker create and execute arbitrary workflows as root inside the platform’s worker container. Real attacks deploying crypto miners and harvesting cloud credentials are already documented. If your team runs Kestra, this is not a “schedule the patch” situation.

Kestra Runs Commands as Root. That’s the Stakes.

Kestra is an open-source workflow orchestrator used by Apple, JPMorgan Chase, Toyota, and thousands of others for data pipelines, ETL jobs, and AI/ML automation. It raised $25M in Series A funding this March and has 26,000+ GitHub stars. Workers execute Shell, Python, and Node.js scripts inside containers — as root — which makes a remote code execution flaw on this platform significantly worse than on a stateless web app.

CVE-2026-49869: One Bad Line of Code

The root cause is almost embarrassingly simple. Kestra’s AuthenticationFilter used a suffix match to whitelist its public configuration endpoint from Basic Authentication:

// VULNERABLE: any path ending in /configs skips auth
if (request.getPath().endsWith("/configs")) {
    chain.doFilter(request, response);
    return;
}

The intent was to exempt only /api/v1/configs. But because Kestra uses resource identifiers in URL paths — like /api/v1/namespaces/{namespace}/configs — any attacker-controlled path ending in /configs bypasses authentication entirely. No credentials required.

The fix is an exact match:

// FIXED: only the specific public endpoint is whitelisted
if (request.getPath().equals("/api/v1/configs")) {
    chain.doFilter(request, response);
    return;
}

One method call. That’s the difference between a functional platform and a CVSS 10.0 vulnerability on CISA’s KEV list. The lesson — “suffix matching is not authorization” — applies well beyond Kestra. Any allowlist that uses string suffixes instead of exact route comparisons is an accident waiting to happen.

What Attackers Are Actually Doing

Exploitation in the wild was documented as early as late June 2026, roughly three months before the CISA KEV designation. The attack chain is straightforward:

1. Send an unauthenticated POST to a path ending in /configs
2. Create a Kestra workflow with a Shell or Python script task
3. Execute as root inside the worker container
4. Establish a reverse shell, run XMRig, enumerate environment variables, and drain mounted cloud credentials

Because Kestra workers often have access to a mounted Docker socket and cloud provider credentials, a compromised worker is not just a compromised machine — it’s a path into your AWS, GCP, or Azure environment.

Affected Versions and the Fix

All Kestra OSS versions before 1.0.45 (in the 1.0 branch) and before 1.3.21 (in the 1.3 branch) are vulnerable. Both patches were released June 3, 2026. See the Kestra v1.3.21 changelog for details. Upgrade to the patched version for your branch. If you are on an unsupported version, migrate to 1.3.21 or later.

If You Ran a Vulnerable Version

Upgrading is step one, but it is not the whole job. If your Kestra instance was reachable from an untrusted network at any point between the fix date and your upgrade, treat the environment as potentially compromised:

• Audit execution history: Check for workflows you did not create, especially those with shell or script tasks
• Review configuration changes: The bypass reaches more than workflow execution — check KV store changes and namespace modifications
• Rotate credentials: Any secret reachable from a Kestra worker (cloud keys, DB passwords, API tokens) should be considered exposed
• Check for persistence: Look for unexpected cron jobs, reverse-shell payloads, or dropped binaries
• Retain logs: Keep reverse-proxy, SIEM, and container platform telemetry for forensic review

If patching immediately is not possible, restrict Kestra’s API to trusted administrative networks as an interim control. Do not run the vulnerable version internet-facing under any circumstances.

The Pattern Keeps Repeating

CVE-2026-49869 joins LiteLLM and Orkes Conductor as workflow orchestration and AI infrastructure tools on CISA’s KEV list this month. A detailed breakdown of the full September 2026 KEV batch is available from The Hacker News. These platforms execute arbitrary code, hold credentials, and are frequently misconfigured with more network access than they need. That makes them high-value targets, and September 2026 makes clear that attackers know it.

The security review your data pipeline team has been deferring is overdue.