Unauthenticated RCE in Kestra OSS: CVE-2026-49869 Explained

A critical vulnerability, CVE-2026-49869, has been identified in Kestra OSS, an open-source workflow orchestrator. Rated with a CVSS 3.1 score of 10.0, this flaw allows for unauthenticated remote code execution (RCE). The vulnerability stems from a path-suffix check within Kestra's AuthenticationFilter. Specifically, any request path that ends with /configs bypasses the necessary Basic Authentication. This is particularly dangerous because the configs identifier can be manipulated within other API routes, enabling attackers to access protected endpoints without any form of authentication.

Kestra OSS, by default, includes script execution plugins. This means that once an attacker gains unauthenticated access, they can create and trigger workflows, leading to the execution of arbitrary commands on the worker nodes. This capability transforms a simple authentication bypass into a full-blown system compromise.

The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on September 2, 2026, signaling its immediate threat to organizations using Kestra OSS.

Identifying Exposed Kestra Instances with ZoomEye

The practical challenge for security teams and administrators is to determine the extent of their exposure: where are these Kestra orchestrators located, and how many are accessible from the public internet? This is precisely where internet-wide scanning services like ZoomEye become invaluable. By leveraging ZoomEye's data, security researchers and defenders can identify potentially vulnerable Kestra instances.

The process involves querying ZoomEye for specific network banners, service versions, or other unique identifiers associated with Kestra. After the discovery of CVE-2026-49869, a surge in scanning activity for Kestra endpoints was observed. ZoomEye's data allows for a snapshot of the internet's exposure to this vulnerability, providing a crucial measurement of risk. It's important to note that search engine data provides a high-level overview; actual exploitation requires successful targeting of specific endpoints and configurations.

The data suggests that numerous Kestra instances were, and potentially still are, exposed to the internet. This exposure is often a consequence of misconfigurations, such as exposing the management interface to public networks without adequate security controls. The ease with which the vulnerability can be triggered—simply by appending /configs to a request—means that automated scanners can quickly find and potentially exploit these systems.

Mitigation and Defense Strategies

For organizations running Kestra OSS, immediate action is required. The primary mitigation is to update Kestra to a patched version. Kestra has released updates that address the authentication bypass flaw in the AuthenticationFilter. Administrators should prioritize applying these updates to all deployed Kestra instances.

If immediate patching is not feasible, network-level controls can provide a temporary defense. This includes:

  • Firewall Rules: Restrict access to Kestra's management interface, allowing connections only from trusted IP addresses or internal networks.
  • Web Application Firewalls (WAFs): Configure WAFs to detect and block requests that attempt to exploit the path-suffix vulnerability. Rules can be designed to identify requests ending in /configs or those attempting to access sensitive configuration endpoints without proper authentication.
  • Network Segmentation: Ensure Kestra instances are placed within secure network segments, isolating them from less trusted zones and the public internet.

Beyond these immediate steps, a thorough security review of Kestra's deployment is recommended. This includes verifying that all unnecessary plugins are disabled, default credentials are changed, and robust access control policies are in place.

Broader Implications for Workflow Orchestrators

The discovery and exploitation of CVE-2026-49869 highlight a broader trend in the security of workflow orchestration tools. These platforms are becoming increasingly powerful and centralized, managing critical business processes and infrastructure. As such, they represent high-value targets for attackers.

The vulnerability in Kestra is a stark reminder that even open-source tools, widely adopted for their flexibility and cost-effectiveness, require rigorous security scrutiny. The reliance on default configurations or inadequate authentication mechanisms can leave even sophisticated systems vulnerable. This incident underscores the need for continuous security monitoring, prompt patching, and a proactive approach to identifying and mitigating risks associated with widely used infrastructure components.

The use of internet-wide scanning data, as demonstrated with ZoomEye, is becoming an essential tool for understanding the attack surface and the prevalence of known vulnerabilities in the wild. This data allows the security community to move beyond theoretical risk to quantifiable exposure, enabling more targeted and effective defense strategies.

What remains to be seen is how quickly organizations will adopt best practices for securing these increasingly critical workflow orchestration systems. The speed at which new vulnerabilities are discovered and exploited in such tools demands a more agile and security-first approach from both developers and operators.