Kestra OSS command-injection flaw CVE-2026-49869 exploited; fixes available
Attackers are exploiting a login bypass in Kestra OSS workflow servers to run code without credentials. Administrators should install 1.0.45 or 1.3.21 for their branch, restrict network access and check for unauthorised workflows.
Nothing to install on family phones or computers: this affects business workflow servers. If your business uses Kestra OSS, ask IT to install 1.0.45 or 1.3.21 for the relevant branch and check workflows and execution logs for unauthorised activity. Until updated, restrict access to trusted networks.
What’s happening
CVE-2026-49869 affects Kestra OSS, software businesses use to automate workflows. Its authentication filter incorrectly exempts some requests from login checks, allowing an attacker with network access to create and run workflows without credentials. Default script plugins let those workflows execute commands with root privileges inside the worker container; Kestra did not confirm an escape to the underlying host. The vendor says installations using Basic Auth are affected, including internal servers an attacker can reach. Kestra identifies 1.0.45 and 1.3.21 as fixed. Check Point’s affected-version wording extends to 1.0.45, conflicting with Kestra’s explicit fixed-version list; the remediation here follows Kestra. CISA confirmed exploitation by adding the flaw to its catalogue on 2 September, and IONIX reports tracking exploitation attempts. As checked on 3 November, the reviewed sources do not identify victims, quantify attacks or establish that exploitation has stopped.
- What
- Flaw
- Affects
- Kestra OSS workflow automation server
- Affected
- Kestra OSS < 1.0.45 using Basic Auth
Kestra OSS >= 1.1.0, < 1.3.21 using Basic Auth - Fixed in
- 1.0.45
1.3.21 - Since
- 2 Sept 2026
- Closed
- 6 Sept 2026
Timeline
- Update
Check Point updated its advisory describing intrusion-prevention coverage for exploitation attempts. Its affected-version wording extends to 1.0.45, whereas Kestra explicitly identifies 1.0.45 as fixed.
- CISA added
CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. CISA's contribution to the CVE record records that listing date.
- Update
The CVE record was published with affected ranges below 1.0.45, and from 1.1.0 up to but excluding 1.3.21. It confirmed both fixed versions.
- Made publicFixed
Kestra published its critical authentication-bypass advisory, naming 1.0.45 and 1.3.21 as patched versions. A network attacker could run code without logging in.
Sources
- Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilterKestra · 3 June 2026
- CVE-2026-49869: CNA record and CISA exploitation listingGitHub CNA, CISA / CVE Program · 3 Sept 2026
- CVE-2026-49869 – Unauthenticated RCE via Authentication Bypass – Kestra prior to 1.0.45 / 1.3.21IONIX · 28 June 2026
- Kestra Remote Code Execution (CVE-2026-49869)Check Point · 6 Sept 2026