EUVD-2026-39922Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity suffix-match bypass needs no privileges or interaction; auth-filter compromise leading to root RCE in the worker crosses a security boundary, so S:C with full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to versions 1.0.45 and 1.3.21, where a flawed authentication whitelist lets attackers reach protected API endpoints without credentials. The AuthenticationFilter exempts the public config endpoint using a suffix match (request.getPath().endsWith("/configs")) instead of an exact path match, so any API path ending in 'configs' bypasses Basic Auth, allowing an attacker to create and run arbitrary workflows. Because the default-enabled script-execution plugins (shell, Python) run inside the worker container as root, this escalates directly to unauthenticated RCE. Carries a maximal CVSS of 10.0; there is no public exploit identified at time of analysis.
Technical ContextAI
Kestra is a Java-based workflow orchestration engine whose REST API gates access through a servlet-style AuthenticationFilter applying HTTP Basic Auth. The vulnerability is rooted in a broken access-control whitelist: the filter intends to leave only the public '/configs' configuration endpoint unauthenticated, but it tests the request path with endsWith("/configs") rather than an exact equality or normalized-route comparison. This suffix matching means crafted paths whose final segment is 'configs' (e.g. an execution/creation route ending that way) are wrongly treated as the public endpoint and skip authentication entirely. The downstream impact is classed as CWE-78 (OS Command Injection) because Kestra bundles script-execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default; a workflow task can therefore invoke shell/Python commands that execute as the root user inside the worker container. The CPE cpe:2.3:a:kestra-io:kestra:*:*:*:*:*:*:*:* identifies all Kestra versions below the fixed releases as affected.
RemediationAI
Upgrade immediately to Kestra 1.0.45 (for the 1.0.x line) or 1.3.21 (for the 1.3.x line), which replace the suffix match with a correct exact-path check; these are the vendor-released patched versions per advisory GHSA-5vc5-wxxq-3fjx (https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx). If patching cannot be done immediately, restrict network access to the Kestra API so it is not reachable from untrusted networks (place it behind a VPN or IP allowlist), and front it with a reverse proxy or WAF rule that enforces authentication and blocks/normalizes request paths whose last segment is 'configs' except the exact legitimate '/configs' route - note this proxy rule is fragile against path-normalization tricks and must be tested carefully. As defense in depth until upgraded, consider disabling or removing the default script-execution plugins (plugin-script-shell, plugin-script-python, etc.) to break the bypass-to-RCE chain, accepting that this disables shell/Python task functionality for legitimate workflows, and run the worker container as a non-root, least-privilege user to limit blast radius.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today