CVE-2026-49869

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21

Description An authentication bypass exists in Kestra OSS due to an improper suffix match in the AuthenticationFilter function. The system uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth, allowing any API path ending in /configs to bypass authentication. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows. Since script execution plugins such as plugin-script-shell and plugin-script-python are enabled by default, this leads to unauthenticated Remote Code Execution as root within the Kestra worker container. This issue has been exploited in real-world attacks.

Recommendations Update to version 1.0.45 or later. Update to version 1.3.21 or later. Remove the Kestra API from the public internet or place it behind a VPN or allowlist. Review workflows and execution history for unauthorized activity and rotate all stored secrets if a compromise is detected.