Actively exploited in the wild
Kestra OSS OS Command Injection Vulnerability
Kestra - Kestra OSS · Listed in the CISA KEV since 2026-09-02. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-49869
CriticalCVSS 10.0KEVExploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
In Kestra OSS prior to versions 1.0.45 and 1.3.21, the AuthenticationFilter uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials.
Risk Assessment
This vulnerability allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) as root inside the Kestra worker container, leading to full system compromise and potential data breach, integrity loss, or denial of service.
Recommendation
Immediately upgrade Kestra to version 1.0.45 or 1.3.21, which contain the fix. Until the update is applied, restrict access to the Kestra API using a firewall or access control lists.
Other vulnerabilities in Kestra
See all- CVE-2026-53576Critical
In Kestra before versions 1.0.45 and 1.3.21, the REST API authentication filter bypasses credential checks for requests ending in '/configs'. An unauthenticated attacker can exploit this to create flows with Shell or Process tasks that execute as root inside the container, and via the mounted /var/run/docker.sock gain access to the host Docker daemon.
- CVE-2026-38428Critical
Kestra version 1.3.3 and earlier is vulnerable to SQL injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization.
- CVE-2026-34612Critical
Kestra prior to version 1.3.7 contains a SQL injection vulnerability in the GET /api/v1/main/flows/search endpoint, allowing an authenticated attacker to achieve remote code execution via PostgreSQL COPY ... TO PROGRAM.
- CVE-2026-55839High
Kestra before version 1.3.24 has a stored XSS vulnerability in its custom Markdown parser. A user with permission to create or update a Flow description can inject JavaScript event-handler attributes via the [[link]] syntax, causing script execution when another user opens the description or information panel.
- CVE-2026-73247High
Kestra before version 2.0.0 passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.
- CVE-2026-73246High
Kestra before version 2.0.0-rc6 serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.
- CVE-2026-73245Medium
A vulnerability in Kestra prior to 2.0.0-rc6 exposes Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels.
- CVE-2026-55069High
A vulnerability in the BasicAuth component of Kestra OSS before version 1.3.24 allows an attacker with read access to the PostgreSQL database to recover the administrator password offline due to SHA-512's high computation speed. In Kubernetes deployments, this enables privilege escalation to read the cluster ServiceAccount token and all K8s Secrets.
- CVE-2026-53577Medium
In Kestra prior to versions 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execution within the same tenant, bypassing execution-level and namespace-level isolation.
- CVE-2026-49984High
In Kestra before versions 1.0.45 and 1.3.23, the local internal-storage backend improperly validates user-supplied paths, allowing an attacker to smuggle a traversal sequence using backslashes (..\..\..\) before conversion to forward slashes. An authenticated user with the lowest privilege can read any file on the server filesystem, including the H2 database, stored secrets, and credentials.
Original NVD description (English source)
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS