---
id: "CVE-2026-49869"
kind: "vulnerability"
aliases: ["CVE-2026-49869"]
title: "Kestra is an open-source, event-driven orchestration platform"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Kestra Kestra OSS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Kestra OSS", "fixed": ["1.0.45", "1.3.21"], "affected": "< 1.0.45; >= 1.1.0, <= 1.3.20", "ecosystem": "maven"}, {"name": "kestra", "fixed": ["1.0.45"], "affected": "< 1.0.45", "ecosystem": "vendor"}, {"name": "kestra", "fixed": ["1.3.21"], "affected": ">= 1.1.0, < 1.3.21", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["auth-bypass", "docker", "exploited", "kestra", "rce", "runtime", "self-hosted", "workflow-orchestration"]
not_affected_if: ["managed-hosting", "patched-1.0.45", "patched-1.3.21"]
published_at: "2026-06-26T22:16:32+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:30:35+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49869", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Kestra is an open-source, event-driven orchestration platform

Kestra OSS AuthenticationFilter whitelists any API path ending in /configs, bypassing Basic Auth. An unauthenticated attacker can create and run a flow with the default shell/python script plugins, giving root RCE inside the worker container. The official docker-compose mounts docker.sock, so the host Docker daemon may be reachable too. CISA KEV lists it as exploited since 2026-09-02, and a public PoC exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kestra Kestra OSS affected ? fixed ?
- maven:Kestra OSS affected < 1.0.45; >= 1.1.0, <= 1.3.20 fixed 1.0.45, 1.3.21
- vendor:kestra affected < 1.0.45 fixed 1.0.45
- vendor:kestra affected >= 1.1.0, < 1.3.21 fixed 1.3.21

## How to check

Check the running Kestra version (UI footer or GET /api/v1/configs). Vulnerable if <= 1.3.20, i.e. < 1.0.45 on the 1.0 line or 1.1.0-1.3.20. Look for unexpected flows (e.g. one named 'configs') and unfamiliar executions or shell tasks. Check whether port 8080 is reachable, and whether docker.sock is mounted in the container.

## Fix

Upgrade to 1.0.45 (1.0 line) or 1.3.21 (1.3 line) or later, and confirm the version after restart. Until then, block network access to the Kestra API port. If the instance was exposed, rotate secrets and cloud credentials held in flows and the secret store, and do a forensic review.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869
- 2026-10-23T21:30:35+00:00 analyst — Read Kestra GHSA-2q47-568g-9h4f/GHSA-5vc5-wxxq-3fjx and NVD: /configs suffix-match auth bypass (CVSS 10.0), fixed 1.0.45 and 1.3.21; KEV added 2026-09-02; public PoC (EQSTLab). X/HN not searched.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49869

## Documents

- [advisory] Kestra GHSA-2q47-568g-9h4f: Unauthenticated RCE via /configs auth-filter bypass https://github.com/kestra-io/kestra/security/advisories/GHSA-2q47-568g-9h4f
- [describes] NVD CVE-2026-49869 https://nvd.nist.gov/vuln/detail/cve-2026-49869
- [discussion] Attackers Exploit Kestra Login Bypass That Reaches Root (nulltap) https://nulltap.com/p/kestra-auth-bypass-rce/
- [fix] Kestra GHSA-5vc5-wxxq-3fjx: AuthenticationFilter auth bypass https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
- [poc] EQSTLab PoC and Docker lab for CVE-2026-49869 https://github.com/EQSTLab/CVE-2026-49869

## From the sources

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container.  This vulnerability is fixed in 1.0.45 and 1.3.21.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_