---
id: CVE-2026-49869
title: 'Kestra is an open-source, event-driven orchestration platform'
summary: >-
  Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45
  and 1.3.21, AuthenticationFilter in Kestra OSS uses
  request.getPath().endsWith("/configs") to whitelist the public configuration
  endpoint from Basic Auth. Bec…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-78
  - CWE-184
  - CWE-287
  - CWE-918
vendor: kestra
product: kestra
affected:
  - kestra < 1.0.45
  - 'kestra >= 1.1.0, < 1.3.21'
patched:
  - kestra 1.3.21
published: '2026-06-26'
updated: '2026-09-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49869'
references:
  - url: >-
      https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
    label: security-advisories@github.com
  - url: >-
      https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.01917
epssPercentile: 0.78986
kev: true
kevDateAdded: '2026-09-02'
kevDueDate: '2026-09-05'
kevRansomware: false
exploited: true
ingestedAt: '2026-09-04T04:14:24.949Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Ap0dexMe0/CVE-2026-49869'
  checkedAt: '2026-09-24T07:53:05.589Z'
exploitAvailable: true
---

## Overview

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container.  This vulnerability is fixed in 1.0.45 and 1.3.21.

## Affected

- `kestra < 1.0.45`
- `kestra >= 1.1.0, < 1.3.21`

## Remediation

Upgrade past the affected range:

- `kestra 1.3.21`