CVE-2026-49869 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-26

Added to CISA KEV: 2026-09-02 68 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized workflow creation/execution, verify system integrity, and inspect worker containers for unauthorized processes or root-level compromise
Immediately upgrade Kestra to version 1.0.45 or 1.3.21 (or later) to remediate the authentication bypass
If immediate patching is not possible, restrict network access to the Kestra API/UI (place behind VPN, firewall, or IP allowlist) and disable or restrict script execution plugins (plugin-script-shell, plugin-script-python)
Monitor for anomalous API requests targeting paths ending in '/configs' and unexpected workflow creation/execution events
Patch priority: CRITICAL/URGENT - apply emergency patching given CVSS 10.0, confirmed active exploitation, and CISA KEV inclusion

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-49869 is a critical authentication bypass and remote code execution (RCE) vulnerability affecting Kestra, an open-source workflow automation platform. The flaw allows unauthenticated remote attackers to bypass login mechanisms by targeting specific API endpoints (specifically those ending in `/configs`), enabling them to create and execute arbitrary workflows that leverage script execution plugins, such as `plugin-script-shell` or `plugin-script-python`. Given that this vulnerability can lead to full system compromise with root-level privileges and has been assigned a CVSS score of 10.0, it poses an extreme risk to any internet-facing Kestra deployments ^[1]^[2].

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog ^[6]^[7].
Proof-of-Concept/Tools: Public awareness and reports confirm the exploitability of this flaw, with specific technical details regarding the bypass of authentication via `/configs` endpoints widely discussed in security research circles ^[1].
Attack Prerequisites:

* Network: Remote access is sufficient; no local access is required. * Authentication: None; the vulnerability explicitly bypasses authentication ^[4]. * User Interaction: None required.

Affected Products & Patches

Affected Versions: Kestra versions prior to the fixed releases.
Patches/Fixes: The vulnerability is resolved in Kestra versions 1.0.45 and 1.3.21 ^[5].
Mitigations:

* Upgrade to the patched versions immediately. * If an immediate upgrade is not possible, disable or restrict the use of built-in script execution plugins, such as `plugin-script-shell` and `plugin-script-python`. * Continuously monitor workflow creation and execution logs for unauthorized or suspicious activity ^[2].

Impact

Access & Capability: Successful exploitation grants an attacker the ability to create and execute arbitrary workflows, leading to remote code execution (RCE) on the underlying server, typically with root or administrative privileges ^[1].
Business Risk: For internet-facing deployments, this vulnerability presents a critical business risk, including potential full system compromise, massive data exfiltration, deployment of ransomware, and unauthorized control over automated business processes ^[3].

Sources

CVE-2026-49869: Kestra's CVSS 10.0 Auth Bypass Flaw
CVE-2026-49869 lets unauthenticated attackers hit any Kestra path ending in /configs, skip login, then run shell commands as root via script ... CVE-2026-49869 lets unauthenticated attackers hit any Kestra path ending in /configs, skip login, then run shell commands as root via script plugins.
CVE-2026-49869 - Vulnerability Details - OpenCVE
Disable or restrict the built‑in script execution plugins such as plugin-script-shell and plugin-script-python until an upgrade is performed. Continuously monitor workflow creation and execution logs for unauthorized activity. Generated by OpenCVE AI on September 3, 2026 at 15:05 UTC. ... An unauthe…
CVE-2026-49869 - Critical Vulnerability - TheHackerWire
How severe is CVE-2026-49869? This vulnerability has a CVSS score of 10 out of 10, rated as Critical. Critical vulnerabilities can be exploited remotely without authentication and may lead to full system compromise, data theft, or malware installation. What Kestra products are affected by CVE-2026-4…
NVD-CVE-2026-49869 - NIST
CVE-2026-49869. An unauthenticated remote attacker can exploit. This vulnerability is fixed in 1.0.45 and 1.3.21.
CVE Record: CVE-2026-49869
Unauthenticated Remote Code Execution via Authentication Bypass. This vulnerability is fixed in 1.0.45 and 1.3.21.

🔴 CVE-2026-49869