CVE-2026-49869

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21

Description An authentication bypass exists in the AuthenticationFilter of Kestra OSS. The system uses a suffix match via request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Since this is not an exact path match, any API path ending with configs bypasses authentication. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows. Due to the default activation of script execution plugins such as plugin-script-shell and plugin-script-python, this can lead to unauthenticated Remote Code Execution as root within the Kestra worker container.

Recommendations Update to version 1.0.45. Update to version 1.3.21.