Exploitation observed; activity peaked at 5 mentions and remains active
Immediate actions
Patch kestra kestra systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-05. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
The post lists several high‑scoring CVEs in Kestra with brief technical details but provides no PoC, exploit code, patches, or evidence of active exploitation.
CVE-2026-49869
Unauthenticated Remote Code Execution in Kestra via Authentication Bypass
https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49869
Post summary
The post announces a newly disclosed CVE‑2026‑49869, describing an unauthenticated remote code execution vulnerability in Kestra due to an authentication bypass, without providing exploit or mitigation details.
CVE-2026-49869 & CVE-2026-53576: Two RCE vulnerabilities in kestra, 10.0 rating 😱
Recently disclosed vulnerabilities in Kestra allow an unauthenticated remote attacker to execute arbitrary code as root.
👉 https://nt.ls/58ToN
Post summary
Two newly disclosed RCE vulnerabilities (CVE-2026-49869 & CVE-2026-53576) in Kestra, rated 10.0, enable unauthenticated remote attackers to execute arbitrary code with root privileges.
Description vs CVSS:
CVE-2026-49869: Unauthenticated RCE via AuthenticationFilter bypass (vs CVSS 9.8)
Source: X search for RCE 2026 exploit
Posted: 2026-06-30T23:57:41.000Z
Likes: 23
Post summary
The post announces CVE‑2026‑49869 as a high‑severity unauthenticated RCE vulnerability, but provides no evidence of exploits, tools, or remediation steps.
The snippet enumerates two high‑severity CVEs with CVSS scores and generic vulnerability descriptions, but offers no actionable or contextual information.
The post announces CVE‑2026‑49869, detailing its high severity and RCE nature, but does not include code, active exploitation evidence, or remediation instructions.
CVE-2026-49869. CVSS 10.0. Unauthenticated RCE in Kestra OSS, and CISA just put it on the KEV list.
If you orchestrate AI or data pipelines, you probably know Kestra. That's what makes this one sting.
WHAT'S BROKEN:
Kestra's AuthenticationFilter has a path exception for public config endpoints. The check is a suffix match: does the path end in "/configs"? Not "does it equal the configs route."
That's the whole bug. Any URL whose last segment happens to be "configs" slides past Basic Auth, no credentials needed. And the advisory says that exempted route pattern reaches more than configs: flows, executions, key-value store, dashboards, logs.
HOW IT BECOMES ROOT:
Kestra ships script-execution plugins (shell, Python, Node) enabled by default. So an attacker who bypassed auth doesn't just read data. They create a workflow, run it, and the worker container executes it as uid 0. Root. From an anonymous HTTP request.
Bonus: the advisory also flags SSRF as a secondary path, since Kestra's templating can fire HTTP requests, meaning a compromised worker can reach internal services or cloud metadata endpoints too.
Affected: everything through 1.3.20. Fixed: 1.0.45 and 1.3.21. Added to KEV on 2026-09-02, federal remediation deadline 2026-09-05, forensic triage required under BOD 26-04.
WHY THIS IS THE PATTERN, NOT THE EXCEPTION:
Suffix matching instead of exact matching on an auth allowlist is one of the oldest bug classes in web security. It just now sits under a workflow engine holding shell access and cloud creds. When your orchestration layer can execute arbitrary code by design, an auth bypass isn't "unauthorized read." It's an unauthenticated root shell wearing a scheduler's clothes.
Building on Kestra, or anything like it (n8n, Airflow, self-hosted orchestrators for agent pipelines)? Ask: does my auth filter do exact path matching, or does it do "ends with"? Is script execution reachable by default, or opt-in? Is the management API sitting on a network anyone can reach?
BEFORE (dangerous): Kestra reachable on a shared internal network, no reverse proxy auth in front, script plugins on by default.
AFTER (safe): upgrade to 1.0.45/1.3.21, put the Kestra UI/API behind an authenticated gateway, and go check your execution history for flows you didn't create.
If your pipeline orchestrator got hit like this tomorrow, would you even know what to look for in the logs?
#AISecurity#CVE#PromptInjection
Post summary
The post announces CVE-2026-49869, describes the authentication bypass and resultant root shell, and provides specific patch versions and mitigation recommendations.
Kestra OSS has a CVSS 10 auth bypass, and CISA's federal due date is today (Sep 5).
CVE-2026-49869: AuthenticationFilter treats any path ending in /configs as public. Unauthenticated attackers can create and run workflows.
Post summary
Kestra OSS suffers a severe CVSS‑10 authentication bypass (CVE‑2026‑49869) that allows unauthenticated attackers to create and run workflows via public /configs paths; a CISA federal due date is set for September 5.
🚨 CVE-2026-49869 — Kestra. One sloppy URL check, full server takeover. Disclosed Jun 26.
What broke: Kestra's login check had one exception — any web address ending in "/configs" was allowed through with no password, because that page is meant to be public. But the check only looked at how the address ends. So an attacker takes a locked admin address, adds "/configs" to the end — and the door swings open. From there they can create a workflow that runs any command on the server. No account, no password.
Who should care: anyone self-hosting Kestra OSS — the open-source workflow orchestrator — on any version before 1.0.45 or 1.3.21. If your Kestra API is reachable from the internet, assume it's being scanned. Kestra Cloud customers are not affected.
Why that matters: Kestra runs your scheduled jobs and data pipelines, so it usually holds passwords and keys for your databases, cloud accounts, and internal APIs. Take over Kestra and you inherit every secret it touches.
Status: exploited in real attacks. CISA added it to the KEV catalog on Sep 2 — the same seven-CVE batch as the Sangoma Switchvox bug. CVSS 10.0, the maximum. EPSS still low (<1%), but KEV means that number no longer matters.
Fix today: upgrade to 1.0.45 or 1.3.21 (or later). Advisory GHSA-5vc5-wxxq-3fjx.
Can't patch: take the Kestra API off the internet or put it behind a VPN/allowlist. Check workflows and execution history for anything you didn't create. If you find something, rotate every secret Kestra stores — patching doesn't undo stolen keys.
Source: GitHub Security Advisory GHSA-5vc5-wxxq-3fjx / CISA KEV (Sep 2) / NVD
#Kestra#CyberSecurity
Post summary
CVE-2026-49869 in Kestra is a fully exploitable server takeover flaw that has already seen real‑world attacks. Urgent mitigation requires upgrading to 1.0.45 or 1.3.21, or isolating the API and rotating exposed secrets.
⚠️ New in CISA KEV this week — exploited in the wild:
• SonicWall SMA1000 Appliances… — CVSS 10
https://notcve.org/cve/CVE-2026-83548
• Kestra OSS OS Command Injection — CVSS 10
https://notcve.org/cve/CVE-2026-49869
• JFrog Artifactory Improper… — CVSS 9.8
https://notcve.org/cve/CVE-2026-82329
Post summary
CISA KEV has added three CVEs—SonicWall SMA1000, Kestra OSS, and JFrog Artifactory—with high CVSS scores, all reportedly exploited in the wild this week.
Microsoft observed active exploitation of AI infrastructure: LiteLLM, RAGFlow, and Kestra deployments compromised for credential theft, persistence, and cryptomining across three distinct intrusion chains.
Key findings:
- LiteLLM gateway compromise chained CVE-2026-42271 (authenticated command execution via MCP stdio) with CVE-2026-48710 (Starlette host-header bypass) for unauthenticated RCE. Attackers read /proc/1/environ for provider API keys and DATABASE_URL, then dumped LiteLLM_ProxyModelTable and LiteLLM_VerificationToken from Azure PostgreSQL via a Python one-liner. Persistence via SSH authorized_keys write, cron, and chattr +i on payload dirs. MITRE: T1190, T1552.001, T1098.004, T1053.003.
- RAGFlow intrusion began with SSRF probing to oast[.]me infrastructure, followed days later by code execution inside the Flask runtime. A Python hook injected into api/__init__.py intercepted provider credentials (OpenAI, Azure, Anthropic, Gemini) on every TenantLLM.insert() call and exfiltrated them to 135.125.10[.]56:19888.
- Kestra exploitation used CVE-2026-49869 (critical auth bypass) to submit a malicious workflow, spawning bash from the Java worker. Attackers accessed the mounted Docker socket to enumerate container Config.Env arrays across all running containers, then deployed XMRig v6.26.0 toward auto.c3pool[.]org. Output stored via Kestra's own KV API.
- C2 and exfil domains: yosemite[.]jp, gobygo[.]net, oast[.]pro/fun/me.
#DFIR_Radar
Post summary
The report confirms Microsoft observed active exploitation of multiple AI infrastructure deployments using known CVEs, detailing the attack chains and affected systems.
CISA KEV: Kestra OSS CVE-2026-49869 (CVSS 10). Federal due Sep 5.
Unauth /configs path-suffix bypass: create workflows, RCE as root in the worker.
Patch to 1.0.45 or 1.3.21. Inventory internet-facing Kestra now.
https://nvd.nist.gov/vuln/detail/CVE-2026-49869
Post summary
CISA has issued a KEV for Kestra OSS CVE‑2026‑49869, an unauthenticated path‑suffix bypass that allows RCE as root (CVSS 10). A patch is available in versions 1.0.45 and 1.3.21.
Kestra auth bypass CVE-2026-49869 (CVSS 10): a filter bug let unauthenticated attackers run workflows via default shell/python plugins for root RCE, now exploited for cryptomining. Patch to 1.0.45/1.3.21. https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
Post summary
A CVE-2026-49869 in Kestra allows unauthenticated root RCE via a filter bug, is actively exploited for cryptomining, and has an available patch (1.0.45/1.3.21).
Kestra OSS skipped Basic Auth on any API path whose last segment was configs. The check used endsWith("/configs") instead of an exact path. That is CVE-2026-49869. CISA added it to the KEV catalog on September 2. Covered federal systems are due today. An unauthenticated caller can create and run a workflow. Script plugins ship enabled, so the worker executes attacker-chosen shell or Python as root in the container. The vendor advisory also notes CRUD on resources named configs, including KV secrets, plus SSRF through the template engine.
Microsoft Threat Intelligence assessed with high confidence that this bug was the entry point in a compromise it published on August 26. After workflow-origin shells, operators queried the mounted Docker socket and read environment arrays from neighboring containers. Those arrays are where cloud keys, database passwords, and API tokens often live. Collected output was stored back through Kestra's own key-value interface.
Fixed builds are 1.0.45 and 1.3.21. If port 8080 was reachable, rotate every secret the worker could see, including values in other containers that shared the socket.
Post summary
The disclosure confirms active exploitation of CVE‑2026‑49869, provides technical details and patch information, and underscores the urgency for rapid remediation.
🚨 Alerte CISA : CVE-2026-49869, RCE critique non authentifiée dans Kestra OSS activement exploitée depuis fin juin 2026 pour des reverse shells. #zoneantimalware https://zoneantimalware.com/cisa-kestra-oss-alerte/
Post summary
CISA reports that CVE-2026-49869, a critical unauthenticated RCE in Kestra OSS, has been actively exploited since late June 2026, delivering reverse shells.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day.
𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 3 Sep 2026
𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan:
🚨 Unauthenticated MCP server access — anonymous clients can list and call an AI gateway's tools, hijacking sessions (LiteLLM CVE-2026-59822)
𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🚨 Auth bypass via path-suffix match — a request ending in /configs skips authentication, reaching workflow creation and RCE as root (Kestra CVE-2026-49869)
Test your stack with NewScan — free, self-hosted:
https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve
#infosec#AppSec#AuthBypass#CSO#REDTEAM
Post summary
The post is a daily CVE report from NewNormal Security, listing newly covered vulnerabilities with brief technical descriptions and a link to test the stack.
CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability
CVSS 10 · EPSS 1% · 6 public exploits
https://notcve.org/cve/CVE-2026-49869 https://t.co/e34UITJgqN
Post summary
The posting announces a severe OS Command Injection vulnerability (CVE‑2026‑49869) with evidence of existing public exploits, though no specific exploit code or active attacks are detailed.
4/7 ⚠️ #Kestra también entró en la cadena.
CVE-2026-49869 permite bypass de autenticación y creación de workflows maliciosos que pueden ejecutar código sin credenciales.
Una plataforma de automatización puede convertirse en herramienta del atacante.
Post summary
The tweet announces that CVE‑2026‑49869 allows authentication bypass and malicious workflow creation, enabling code execution without credentials in Kestra.
I would treat an AI gateway the way I treat a domain controller. Microsoft's incident team just published three compromises that say the same thing.
LiteLLM: CVE-2026-42271 chained with CVE-2026-48710 for remote code execution, then credential theft, database access and cryptomining. RAGFlow: provider credentials intercepted through application hooks. Kestra: CVE-2026-49869 authentication bypass, then container discovery and mining.
Post-compromise looked the same each time. Environment variables harvested, Postgres connection strings pulled, XMRig deployed, SSH keys added, cron edited.
The controls Microsoft recommends:
1. Patch and enforce authentication on the gateway like it is a domain controller
2. Issue per-team virtual keys with spend limits. Retire the master key.
3. Deny-by-default egress, with an allowlist for model providers
4. Alert on child processes and credential reads from the gateway runtime
A gateway is a control plane. Attackers already file it under that heading.
https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
Post summary
Microsoft reports three real-world exploits of CVE‑2026 vulnerabilities targeting AI gateways, describing post‑compromise activities and recommending mitigation controls.
A fixed version closes the vulnerability. It does not tell you whether the vulnerable service was already used.
CISA added CVE-2026-49869 to the Known Exploited Vulnerabilities catalog, so affected Kestra systems deserve more than a version check.
The operational sequence matters: establish exposure, preserve evidence, update, and then scope what the worker could access.
Otherwise, teams risk turning vulnerability management into a binary state change while leaving the incident question unanswered.
**In practical terms, it is a good time to:**
- confirm the exact running Kestra version rather than relying only on deployment manifests
- determine when the vulnerable instance became reachable from untrusted networks
- preserve API, workflow, reverse-proxy, and runtime logs covering that exposure window
- compare workflow execution history with expected schedules and operators
- verify the deployment has moved to a vendor-fixed release supported by the environment
Patch management and incident response overlap whenever exploitation is already confirmed.
Full coverage:
#VulnerabilityManagement#IncidentResponse#LinuxSecurity#PatchManagement#OpenSource https://linuxsecurity.com/news/hackscracks/kestra-vulnerability-linux-container-rce
Post summary
The post notes that CVE‑2026‑49869 is listed as a known exploited vulnerability and stresses the importance of verifying running Kestra versions, preserving evidence, and promptly applying the vendor‑fixed release.
