CVE-2026-49869

What it actually does

AuthenticationFilter performs a suffix match on request.getPath().endsWith("/configs") instead of an exact match, allowing any API path terminating in /configs to bypass Basic Auth entirely and reach workflow creation/execution endpoints; combined with default-enabled script execution plugins this yields unauthenticated RCE as root inside worker containers.

Why it matters to the business

Attackers can create and run arbitrary workflows that execute code on orchestration infrastructure without credentials, enabling full compromise of automation pipelines, data exfiltration, and operational disruption; active exploitation and CISA KEV listing with a September 2026 remediation deadline require immediate action.

How an attack unfolds

An unauthenticated remote attacker sends HTTP requests whose paths end with /configs to evade the AuthenticationFilter, obtains unauthenticated access to the workflow API, creates a workflow that invokes plugin-script-shell or plugin-script-python, and executes it to run arbitrary commands as root inside the Kestra worker container.

How to fix it

Upgrade Kestra OSS to version 1.0.45 or 1.3.21 (or later) to replace the suffix-based path check with an exact match; until patches are applied, restrict network access to the API and disable unnecessary script plugins.

How to confirm the fix worked

Confirm installed version is at least 1.0.45 or 1.3.21; test that requests to non-exact paths ending in /configs now receive 401 responses; review AuthenticationFilter source for exact path equality check.

Typical attack path

1. Craft HTTP request to any path ending in /configs to bypass authentication
2. Call workflow creation API without credentials
3. Define workflow containing malicious script-execution task
4. Trigger workflow execution to obtain RCE as root

How to detect it

Inspect web server or API gateway logs for requests whose paths end with /configs that lack authentication tokens or receive successful responses; correlate with subsequent workflow creation events and script-plugin task executions in Kestra audit logs.

• request path endsWith /configs returning 200 without Authorization header
• workflow creation API calls lacking credentials
• plugin-script-shell or plugin-script-python task execution from newly created workflows

What your security team should do

• Apply the 1.0.45 or 1.3.21 upgrade immediately given KEV status and active exploitation
• Add network controls to limit unauthenticated API access until patched
• Audit existing workflows for unauthorized creation or execution artifacts
• Monitor EPSS trend and threat actor activity for increased targeting