noindex and left out of the sitemap until more data is confirmed.CVE-2026-49869 is an authentication-bypass flaw in Kestra OSS's AuthenticationFilter: a suffix match on "/configs" instead of an exact-path match lets an unauthenticated attacker reach real workflow endpoints through any URL ending in that suffix, create and run an arbitrary workflow, and execute commands as root via Kestra's default script plugins. It is on CISA's KEV catalog, but NVD's own vulnerability-status field is "Analyzed" without an NVD-published Primary score — only the vendor's own 10.0 CVSS submission exists — so per our indexing policy this page stays pending with no NVD-confirmed cvss_score.
Vulnerability summary
N/A
Not yet scored
2.1%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-06-26
Published
Vulnerability ID: CVE-2026-49869 · Source: GitHub Advisory GHSA-5vc5-wxxq-3fjx (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Kestra OSS | cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:* | before 1.0.45; 1.1.0 through 1.3.20 (fixed in 1.0.45 and 1.3.21) |
What this means
CVE-2026-49869 is an authentication-bypass vulnerability (CWE-287 Improper Authentication, CWE-78 OS Command Injection, CWE-184 Incomplete List of Disallowed Inputs, CWE-918 SSRF) in Kestra OSS, an open-source event-driven workflow orchestration platform. NVD's description states: "AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials" (NVD).
NVD's vulnStatus for this record is Analyzed, but NVD has not published its own independent Primary CVSS score; the only metric on record is GitHub's CNA-submitted Secondary rating of CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD). So the 10.0 figure is the CNA Secondary score, not an NVD-confirmed Primary score, and is not used as this page's cvss_score.
The Kestra security advisory spells out the attack chain: an unauthenticated request to a path such as PUT /api/v1/main/flows/tutorial/configs is wrongly allowed through the Basic Auth filter because the path ends in "/configs", even though the real target is the flow-management API, not the public config endpoint. An attacker can upload a malicious flow definition that way, then trigger it with a similarly suffixed POST /api/v1/main/executions/tutorial/configs. Because Kestra ships script-execution plugins such as plugin-script-shell and plugin-script-python enabled by default, the uploaded flow runs arbitrary commands as root inside the Kestra worker container — giving unauthenticated remote code execution, with the advisory additionally flagging that this can be used to reach cloud-metadata endpoints and steal AWS/GCP/Azure credentials via SSRF. Affected versions are before 1.0.45 and 1.1.0 through 1.3.20; fixed in 1.0.45 and 1.3.21, with no workaround short of upgrading (Kestra Security Advisory GHSA-5vc5-wxxq-3fjx).
CISA added CVE-2026-49869 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02 (catalog version 2026.10.28, 1762 entries, confirmed live this run), flagged forensic-triage-required under BOD 26-04, with a required-action due date of 2026-09-05 — one of the shortest windows in the catalog, reflecting the unauthenticated-RCE severity, though the catalog does not record known ransomware use (CISA KEV).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.02095 (81.593th percentile) — notably lower than the KEV listing alone might suggest, consistent with Kestra's smaller, more specialized deployment footprint compared to mass-market software (FIRST EPSS).
Until NVD completes its analysis, treat the 10.0 figure as indicative only, not NVD-confirmed. Any Kestra OSS instance before 1.0.45 (or 1.1.0-1.3.20) should be upgraded immediately regardless of network exposure, since the flaw requires no credentials and defaults to root-level script execution.
Evidence
- AuthenticationFilter in Kestra OSS whitelists any path ending in "/configs" via suffix match instead of exact match, letting an unauthenticated attacker reach real workflow endpoints and create/execute arbitrary workflows. — NVD
- CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — GitHub's CNA Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
- Exploit chain: a /configs-suffixed path bypasses Basic Auth to reach the real flow-management API; an uploaded flow using default-enabled script plugins (shell/Python) executes as root inside the worker container, including SSRF access to cloud metadata. Affected before 1.0.45 and 1.1.0-1.3.20, fixed in 1.0.45/1.3.21. — Kestra Security Advisory GHSA-5vc5-wxxq-3fjx
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-02 (catalog version 2026.10.28, 1762 entries), forensic-triage required under BOD 26-04, required-action due date 2026-09-05. — CISA KEV
- EPSS score is 0.02095 (81.593th percentile) as of 2026-10-28. — FIRST EPSS
