Kestra CVE-2026-49869: one endsWith() call, root RCE

If you run Kestra, the open-source workflow orchestrator, stop reading and check your version. CVE-2026-49869 is a CVSS 10.0 authentication bypass that gives an unauthenticated attacker remote code execution as root inside the worker container. CISA added it to the Known Exploited Vulnerabilities catalog on September 2. Patched releases are 1.0.45 and 1.3.21; everything through 1.3.20 is affected.

What actually happened

The bug is one line. AuthenticationFilter.java whitelists the public config endpoint from Basic Auth like this:

request.getPath().endsWith("/configs")

Suffix match, not exact match. So any API path whose final segment is configs skips authentication entirely. The advisory spells out the endpoints that fall out of that:

• PUT /api/v1/{tenant}/flows/{namespace}/configs — create a workflow
• POST /api/v1/{tenant}/executions/{namespace}/configs — run it
• Similarly-named paths to modify the KV store and delete audit logs

Kestra ships script execution plugins — shell.Commands, python.Script — enabled by default. So "create and run an arbitrary workflow" is just a slower way of saying "run any command as root." The advisory also notes the Pebble template engine's unrestricted http() function, which turns the same foothold into SSRF against internal services and cloud metadata endpoints.

Microsoft documented real-world exploitation going back to late June 2026: reverse shell, Docker environment discovery, defense evasion, cryptominer deployment, and data harvesting out of the key-value store. The audit-log deletion path is why "we'd have seen it" is not a safe assumption.

Why a self-hosted orchestrator matters for your business

An orchestrator is the worst possible thing to lose. It holds credentials for everything it automates — database connections, S3 keys, API tokens for every SaaS in your stack — because that's the job. Compromising Kestra isn't compromising Kestra. It's compromising the list of things Kestra talks to.

Three things to do today. Check the version and patch to 1.0.45 or 1.3.21. Check whether it's reachable from the internet at all — most self-hosted orchestrators end up on a public IP because someone needed a webhook, and then nobody moved it behind a VPN. Rotate the credentials it holds if you were on an affected release with any public exposure, because the KV store was a documented harvest target.

Then look at the pattern, not just the CVE. endsWith() on a request path is a mistake that appears in a lot of hand-rolled auth middleware, and it is worth grepping your own codebase for. We wrote about the same class of exposure when Windmill shipped its own auth bypass. Self-hosted automation is genuinely the right call for most small teams — it just means the patch cadence is yours now.

Sources: Kestra security advisory GHSA-5vc5-wxxq-3fjx, CISA KEV alert, The Hacker News.