Critical Unauthenticated RCE Vulnerability in Kestra Orchestration Platform
Overview
CVE-2026-49869 exposes Kestra users to unauthenticated remote code execution with root privileges due to a flawed authentication bypass in the /configs endpoint. This critical vulnerability affects default installations with script execution plugins enabled.
Technical Analysis
The AuthenticationFilter's use of a suffix match (request.getPath().endsWith("/configs")) instead of an exact path check allows attackers to craft arbitrary API paths ending in 'configs'. This bypasses authentication entirely, enabling workflow creation and execution through default plugins like plugin-script-shell and plugin-script-python. Exploitation requires no credentials and directly achieves container-level code execution as root.
Enterprise & DIB Impact
Defense industrial base and enterprise environments using Kestra for workflow automation face immediate risk of system compromise, data exfiltration, and operational disruption. Attackers can leverage this vulnerability to establish persistent access without requiring any user credentials or network pivoting.
Recommended Actions
- Upgrade to Kestra 1.0.45 or 1.3.21 immediately
- disable unused script execution plugins
- implement network-level access controls for Kestra APIs
- monitor logs for anomalous /configs endpoint activity
- apply the principle of least privilege to worker container privileges.
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →