CVE-2026-49869
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk48th percentile — higher than 48% of all known CVEs
Summary
In Kestra OSS prior to versions 1.0.45 and 1.3.21, the AuthenticationFilter uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials.
Risk Assessment
This vulnerability allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) as root inside the Kestra worker container, leading to full system compromise and potential data breach, integrity loss, or denial of service.
Recommendation
Immediately upgrade Kestra to version 1.0.45 or 1.3.21, which contain the fix. Until the update is applied, restrict access to the Kestra API using a firewall or access control lists.
Original NVD description (English source)
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.