CVE-2026-49869

What is Kestra?

Kestra is an open-source workflow orchestration and scheduling platform ("Airflow-alternative") used to build event-driven data and automation pipelines, defined declaratively in YAML and executed by workers that frequently run inside Docker with broad access to databases, cloud credentials, and internal APIs. A platform whose core feature is "run arbitrary tasks on schedule" is inherently a remote-code-execution engine — which is why an authentication bypass in front of it is a worst-case event.

Overview

CVE-2026-49869 is carried in KEV as an OS command injection (CWE-78), but the root flaw is an authentication bypass in Kestra's AuthenticationFilter that lets an unauthenticated remote attacker create and execute arbitrary workflows. Because Kestra ships script-execution plugins by default, "create a workflow" equals "run shell commands as root in the worker container" — CVSS 10.0. Microsoft threat intelligence documented in-the-wild exploitation beginning late June 2026, and CISA added it to KEV on 2026-09-02 with an accelerated three-day remediation deadline.

Affected Versions

Technical Details

Kestra's AuthenticationFilter exempts the public configuration endpoint from Basic Auth using request.getPath().endsWith("/configs") — a suffix match instead of an exact path match. Any API path whose final segment is configs therefore bypasses authentication entirely, and attackers crafted such paths to reach the workflow-management APIs without credentials.

From there the path to code execution is direct: create a workflow using one of the script plugins enabled by default (plugin-script-shell, plugin-script-python, etc.) and trigger it. Commands execute as root inside the Kestra worker container. The attack requires no authentication, no user interaction, and only a few HTTP requests (create + trigger); the changed scope in the CVSS vector reflects the jump from the web API into the execution environment.

Discovery

Disclosed via Kestra's GitHub security advisory GHSA-5vc5-wxxq-3fjx (discovery credit not published). In-the-wild exploitation was documented by Microsoft threat intelligence.

Exploitation Context

Exploitation began in late June 2026. Observed tradecraft: establishing reverse shells from workflow tasks, Docker container environment discovery and defense evasion, cryptocurrency-miner deployment, and data harvesting — including a curl-pipe-to-shell workflow event that base64-encoded collected output and stashed it through Kestra's own key-value store interface. The activity is part of the broader 2026 campaign against AI/automation infrastructure that also hit LiteLLM (CVE-2026-59822, CVE-2026-42271) and Starlette (CVE-2026-48710). CISA's 2026-09-05 due date — three days after KEV addition rather than the usual three weeks — signals how actively it was being exploited.

Remediation

1. Upgrade to Kestra 1.3.21 or 1.0.45 immediately. Federal deadline: 2026-09-05.
2. Do not expose the Kestra API/UI to the internet. Place it behind a VPN or authenticating reverse proxy regardless of patch status.
3. Hunt for compromise before trusting the instance: review workflow definitions for anything you didn't author (especially shell/python script tasks), audit execution history since late June 2026, inspect the key-value store for staged/exfiltrated data, and check worker containers for miners, reverse-shell processes, and unexpected outbound connections.
4. Rotate every secret reachable from Kestra (database credentials, cloud keys, API tokens configured in workflows) if the instance was exposed while vulnerable.
5. Run workers with least privilege — non-root containers and restricted egress limit the blast radius of workflow-level RCE.