Kestra Authentication Bypass to Workflow RCE
- Product
- Kestra Kestra OSS
- CVE
- CVE-2026-49869
- Disclosed
- 2026-06-03
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Kestra OSS < 1.0.45 and 1.1.0 - 1.3.20
- Fixed
- 1.0.45, 1.3.21
Summary
Kestra, an open-source orchestration platform, whitelisted its public config endpoint with a suffix match. Any API path ending in 'configs' skipped authentication, letting attackers create and run workflows that execute scripts. CISA added it to KEV in September 2026.
Root cause
AuthenticationFilter used request.getPath().endsWith("/configs") to exempt the public configuration endpoint from Basic Auth. Because it was a suffix check rather than an exact match, attacker-chosen paths (e.g. namespace or flow IDs named 'configs') bypassed authentication. Script plugins (shell, Python) are enabled by default, so creating and triggering a flow runs arbitrary commands as root in the worker container.
Impact
Unauthenticated remote code execution in Kestra workers and access to stored secrets.
Detection
Look for unauthenticated API requests whose final path segment is 'configs' other than the real config endpoint, and for new flows using script tasks; version check.
Mitigation
Upgrade to 1.0.45 / 1.3.21 or later and keep the Kestra API off the internet.