Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-49869: Kestra: Unauthenticated Remote Code Execution via Public Configs

CVE-2026-49869

Summary

An open-source platform used for workflow orchestration has a security flaw that allows unauthorized access to its configuration settings. This can lead to unauthenticated users executing arbitrary code on the system, which could result in data loss or system compromise. Users should update to the latest version of Kestra, specifically 1.0.45 or 1.3.21, to fix this issue.

Original title

Original description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

nvd CVSS3.1 10.0

Vulnerability type

CWE-78 OS Command Injection

CWE-184

CWE-287 Improper Authentication

CWE-918 Server-Side Request Forgery (SSRF)

https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx

Published: 26 Jun 2026 · Updated: 23 Jul 2026 · First seen: 26 Jun 2026