Read the docs
TI-2026-36769 Aliases CVE-2026-49869

Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

Priority CRITICAL 100Exploited in the wildCWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287 and CWE-78.

Summary

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

Why it matters now

Exploitation Active In CISA KEV since 2026-09-02CISA due date 2026-09-05
EPSS 0.02095 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kestra (kestra-io): 1.0.45, 1.3.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kestrakestrabefore 1.0.45; 1.1.0 to before 1.3.211.0.45, 1.3.21Patch availableCNA
  • kestra VendorKestra Affected before 1.0.45; 1.1.0 to before 1.3.21 Fixed in 1.0.45, 1.3.21 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*before 1.0.45; 1.1.0 to before 1.3.21VulnerableKestra
  • cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:* Versions before 1.0.45; 1.1.0 to before 1.3.21 Vulnerable ·Kestra

Remediation

  • Fix · CNA kestra (kestra-io) Fixed in 1.0.45, 1.3.21

Timeline

  1. 2026-09-02 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-49869

References

Exploit 1

  • TI-2026-38637 Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass CVSS 3.1CRITICAL 10.0
  • TI-2026-28138 Kestra v1.3.3 and before is vulnerable to SQL Injection. CVSS 3.1CRITICAL 9.8
  • TI-2026-26858 Kestra: Remote Code Execution via SQL Injection CVSS 3.1CRITICAL 10.0
  • TI-2026-39775 Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack CVSS 3.1HIGH 8.7
  • TI-2026-36817 Information disclosure in kestra CVSS 3.1HIGH 7.7
  • TI-2026-33542 Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file read CVSS 3.1HIGH 7.7
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences