Vulnerabilities

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.

CVE-2026-49869 is a critical (CVSS 3.1: 10.0) authentication bypass in the open-source Kestra event-driven orchestration platform: the AuthenticationFilter exempts the public configuration endpoint from Basic Auth using a suffix match (request paths ending in "/configs") rather than an exact path comparison. As a result, an unauthenticated remote attacker can call any API URL whose final path segment is "configs", which is enough to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly yields unauthenticated remote code execution as root inside the Kestra worker container. All Kestra OSS deployments prior to 1.0.45 and 1.3.21 are affected, with the greatest risk for instances whose API is reachable from the internet or untrusted networks. The flaw is being actively exploited: CISA added it to the KEV catalog on 2026-09-02 (EPSS 1.9%, percentile 79), and headlines covering the KEV batch report attackers deploying reverse shells and crypto miners.

Do: Upgrade to Kestra 1.0.45 (for the 1.0.x line) or 1.3.21 (for the 1.3.x line), or later releases that incorporate the fix. If immediate patching is not possible, restrict network access to the Kestra API (firewall/ACL or a reverse proxy that enforces authentication for all paths, including any ending in /configs). Given active exploitation, audit instances for signs of compromise such as unexplained workflows, reverse shells, or cryptomining processes in worker containers; federal agencies must patch per CISA BOD 26-04 timelines.