- Critical 10.0
- Known exploited (CISA KEV)
CVE-2026-49869
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) ena…
Scores
The facts
- Published
- 26 June 2026
- Last changed
- 3 September 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 10.0 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- Affects
- kestra kestra
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 2 September 2026.
- EPSS
- 2.1% chance of exploitation activity in the next 30 days (percentile 81).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.