CVE-2026-49869: Kestra Authentication Bypass RCE Flaw

CVE-2026-49869 Overview

CVE-2026-49869 is an authentication bypass vulnerability in Kestra, an open-source event-driven orchestration platform. The AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check performs a suffix match rather than exact path matching, any API path ending in configs bypasses authentication entirely. An unauthenticated remote attacker can create and execute arbitrary workflows without credentials. Since Kestra ships with script execution plugins such as plugin-script-shell and plugin-script-python enabled by default, exploitation results in unauthenticated Remote Code Execution as root inside the Kestra worker container. The vulnerability is fixed in versions 1.0.45 and 1.3.21.

Critical Impact
Unauthenticated remote attackers can achieve root-level Remote Code Execution inside Kestra worker containers by abusing a suffix-match authentication filter to invoke workflow execution APIs.

Affected Products

Kestra OSS versions prior to 1.0.45
Kestra OSS versions prior to 1.3.21
Kestra deployments with default script execution plugins enabled

Discovery Timeline

2026-06-26 - CVE-2026-49869 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-49869

Vulnerability Analysis

The flaw resides in Kestra's AuthenticationFilter component, which enforces Basic Auth across the API surface. The filter carves out an exception for the public configuration endpoint so unauthenticated clients can retrieve boot-time configuration. The exemption relies on request.getPath().endsWith("/configs") rather than comparing the full request path. This maps to [CWE-78] category handling within the platform's request routing logic.

Any attacker-controlled API route whose final path segment ends with configs inherits the authentication exemption. Kestra exposes REST endpoints for creating flows and triggering executions, and attackers can craft paths that both hit those endpoints and satisfy the suffix check. Once past the filter, the attacker interacts with the full authenticated API as an anonymous user.

Root Cause

The root cause is improper input validation of the request path during authentication whitelisting. Suffix matching is not equivalent to exact path matching. The correct check requires comparing the normalized request path to the literal string /configs or using a strict routing predicate. The permissive comparison collapses the security boundary between public metadata and privileged workflow control APIs.

Attack Vector

The attack is network-reachable and requires no privileges or user interaction. An attacker sends an HTTP request to a Kestra API endpoint using a path that terminates in configs to bypass Basic Auth. The attacker then submits a workflow definition that invokes the shipped plugin-script-shell or plugin-script-python tasks. Kestra dispatches the workflow to a worker container, which executes the attacker-supplied shell or Python code as root. This yields full command execution inside the worker and any credentials, secrets, or network access available to it.

Detection Methods for CVE-2026-49869

Indicators of Compromise

Unauthenticated HTTP requests to Kestra API paths whose final segment is configs but which are not the legitimate /api/v1/configs endpoint.
Creation of new flows or executions immediately following requests to suffix-crafted paths from external IP addresses.
Worker container processes spawning sh, bash, or python with commands unrelated to legitimate scheduled workflows.
Outbound network connections from Kestra worker containers to unfamiliar IP addresses or command-and-control infrastructure.

Detection Strategies

Inspect HTTP access logs for request paths matching .*configs$ that are not exact matches for the documented public configuration endpoint.
Correlate anonymous (no Authorization header) requests with subsequent flow creation or execution events in Kestra audit logs.
Alert on new workflows containing io.kestra.plugin.scripts.shell or io.kestra.plugin.scripts.python tasks created outside change management windows.

Monitoring Recommendations

Enable and centralize Kestra API audit logs and worker execution logs to a SIEM for correlation.
Monitor Kestra worker containers for unexpected child processes, file writes to /tmp, and outbound network activity.
Baseline the set of users and service accounts that legitimately create flows, and alert on deviations.

How to Mitigate CVE-2026-49869

Immediate Actions Required

Upgrade Kestra OSS to version 1.0.45 or 1.3.21 immediately.
Restrict network access to the Kestra API using firewall rules or a reverse proxy that requires authentication before requests reach Kestra.
Rotate any credentials, API tokens, and secrets accessible from Kestra worker containers, assuming compromise if the instance was internet-exposed.
Review flow and execution history for unauthorized entries created before the patch was applied.

Patch Information

Kestra has released fixed versions 1.0.45 and 1.3.21. Both releases replace the suffix-based whitelist with an exact path check in AuthenticationFilter. Details are published in the Kestra GitHub Security Advisory GHSA-5vc5-wxxq-3fjx.

Workarounds

Place Kestra behind a reverse proxy such as NGINX or an API gateway that enforces authentication and blocks requests whose paths end in configs except for the exact /api/v1/configs route.
Disable script execution plugins (plugin-script-shell, plugin-script-python, and related) if they are not required by production workflows.
Run Kestra workers as a non-root user and apply strict container security contexts to limit blast radius if exploitation occurs.

bash

# NGINX example: block suffix-match bypass while allowing the legitimate endpoint
location ~ /configs$ {
    if ($request_uri !~ "^/api/v1/configs(\?.*)?$") {
        return 403;
    }
    proxy_pass http://kestra_backend;
}