Kestra CVE-2026-49869

Exploitation requires only network reachability to the Kestra OSS API on a vulnerable version (below 1.0.45 / 1.3.21) and that the default-bundled script-execution plugins (plugin-script-shell, plugin-script-python, etc.) remain enabled - both of which hold in a default installation, so no authentication, user interaction, or non-default setting is needed. The specific trigger is sending an API request whose path's final segment is 'configs', which the endsWith() whitelist treats as the unauthenticated public config endpoint. Limiting factors that reduce real-world exposure: the API must be network-accessible to the attacker (internal-only or segmented deployments are harder to reach), and environments that have removed/disabled the script plugins lose the auth-bypass-to-RCE escalation though the auth bypass itself remains.

Every available signal points to top-tier, immediately actionable risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity, and availability impact and a scope change, which aligns precisely with the described auth-bypass-to-root-RCE chain - there is no contradiction between the vector and the description. The flaw is automatable (no user interaction, deterministic suffix-match bypass) and yields total technical impact, the kind of profile that an SSVC framework would push toward immediate 'Act'. The mitigating factor is reach: exploitation requires network access to the Kestra API, so internet-exposed or broadly-networked instances are at far higher risk than tightly segmented internal deployments. Notable data gaps: this CVE is NOT listed in CISA KEV, no EPSS score was provided, and no public proof-of-concept was supplied, so active or widespread exploitation cannot be asserted - but the trivial nature of the bug (a one-character logic error reachable pre-auth) means weaponization would be straightforward once details are public, and the underlying GitHub Security Advisory discloses the root cause.

An attacker who can reach the Kestra API over the network sends a crafted request to an endpoint whose path ends in 'configs', which the AuthenticationFilter wrongly treats as the public config endpoint and serves without credentials. Using this unauthenticated access the attacker creates and triggers a workflow containing a shell or Python script task, which the default-enabled plugins execute as root inside the worker container, yielding full remote code execution. No public exploit was identified at time of analysis, but the bug is trivial to reproduce from the advisory.