External risk intelligence

Kestra OSS Authentication Bypass Leading to RCE

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-49869

Kestra is an orchestration platform designed as an API-driven service. Because it involves managing workflows and typically exposes an API endpoint to facilitate these operations, it is commonly deployed as an internet-facing or network-accessible service to interact with external systems and users.

OS Command Injection

Kestra

before 1.0.451.1.0 to before 1.3.21

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Kestra, an open-source orchestration platform, allowing unauthenticated attackers to bypass security controls and execute arbitrary code as root. The issue stems from an improperly configured authentication filter that incorrectly validates API paths. This could lead to the compromise of the Kestra worker container.

Unauthenticated access bypasses security for workflow execution.
Critical for systems managing automated processes.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a flaw in how Kestra handles authentication for configuration endpoints. By crafting a request to an API path that ends with "/configs," an attacker can bypass authentication entirely. This allows them to create and execute arbitrary workflows, which, due to the default inclusion of script execution plugins, can lead to unauthenticated remote code execution with root privileges within the Kestra worker container.

No authentication required.
Accessing a path ending in "/configs."
Unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could exploit a flaw in Kestra's authentication filter to bypass credential checks and create or execute arbitrary workflows. This could lead to unauthenticated Remote Code Execution as root within the Kestra worker container, especially when script execution plugins are enabled by default.

Arbitrary workflow execution and RCE.
Bypassing authentication via specific path suffix.
Unauthenticated root code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Kestra platform's authentication bypass vulnerability requires immediate attention from teams responsible for the orchestration platform and its security posture. The first step is to identify all Kestra instances, determine their network exposure and business criticality, and then locate the specific team or individual accountable for the platform. Remediation planning should be prioritized based on this risk assessment.

Orchestration platform owners should address this.
Verify unauthenticated API endpoint access.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kestra and what is it used for?

Kestra is an open-source, event-driven orchestration platform. It is designed to automate complex data pipelines, infrastructure management, and business processes. Because it functions as an API-driven service, it is frequently used to coordinate interactions between various external systems, applications, and services, making it a central engine for managing automated workflows across a technical environment.

What does CVE-2026-49869 mean?

This CVE describes a failure in Kestra's authentication mechanism. It is classified primarily under CWE-287 for improper authentication and CWE-184 for incomplete list-based normalization. The software incorrectly checks if a request path ends in a specific string rather than validating the exact path. This flaw allows unauthorized users to bypass security checks and access protected endpoints, eventually leading to arbitrary code execution (CWE-78).

How can an attacker trigger this vulnerability?

An attacker exploits the bug by sending a crafted API request that ends with the string "/configs". Because the authentication filter uses a suffix match, the application incorrectly assumes the request is authorized. Note that simply browsing the API is not enough; the attacker must be able to reach the Kestra API and successfully craft these requests. The bug does not trigger if the request path does not terminate with the "/configs" suffix.

Is my Kestra instance at risk?

According to Halo Surface Signal, Kestra is often deployed as an internet-facing or network-accessible service to facilitate its role as an orchestration platform. If your Kestra deployment is reachable over the network or the internet, it is at higher risk. You should assess whether your instance is exposed to untrusted networks or if it is strictly confined to an internal, protected environment.

What should I do first to address this?

Begin by auditing your environment to identify all active Kestra instances. Verify their network accessibility and determine which ones are running versions prior to 1.0.45 or 1.3.21. Prioritize these vulnerable instances based on their connectivity to external networks and the sensitivity of the automated workflows they manage. Coordinate with your team to schedule and apply the update to the latest patched version.

References

github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.