CISA Adds Kestra OSS Vulnerability to Actively Exploited Vulnerabilities List
The CVE-2026-49869 flaw allows attackers to bypass Basic Auth without logging in, create workflows and, under certain conditions, execute commands in the worker. Versions 1.0.45 and 1.3.21 contain fixes.
The Kestra OSS vulnerability tracked as CVE-2026-49869 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026. The entry means CISA has evidence that it is being exploited in the wild. On internet-accessible instances, the issue may allow an unauthenticated attacker to create and run workflows.
The vulnerability affects the Basic Auth mechanism. Incorrect path matching for a path ending in /configs allows authentication to be bypassed without credentials. If scripting plugins are available in the deployment, the result may be remote command execution in the worker environment.
Kestra OSS vulnerability: which versions need to be fixed
Kestra OSS versions before 1.0.45 and versions 1.1.0 through before 1.3.21 are vulnerable. Fixes are available in releases 1.0.45 and 1.3.21.
Operators should prioritize updating instances to the applicable fixed version and check whether their systems show signs of unauthorized workflow creation or execution. Deployments in which workers can access internal services, data or secrets are particularly relevant.
- Version 1.0.x: update to at least 1.0.45.
- Versions 1.1.0 through before 1.3.21: update to at least 1.3.21.
- Instances accessible from the internet should receive particular priority.
KEV confirms documented exploitation
The KEV catalog collects vulnerabilities that CISA considers exploited. For organizations subject to CISA’s binding directives, the agency set a remediation deadline of September 5, 2026. This deadline is not generally binding on all operators, but inclusion in KEV is a practical signal to address the issue urgently.
Microsoft identified this vulnerability with a high degree of confidence as a likely initial access vector in a Kestra compromise. CISA did not disclose a specific group, scope or timeframe for the exploitation in its entry.
It is also not confirmed that the vulnerability has been used in ransomware campaigns; the KEV catalog lists this item as unknown. The vulnerability’s inclusion in KEV does not itself mean that attackers compromised every publicly accessible Kestra instance.
Risk stems from the role of workers
Kestra is a workflow orchestration platform. Successful exploitation therefore may not stop at bypassing login to the interface: an attacker can create and run a workflow. When scripting plugins are available, this capability extends to executing commands in the worker.
The scope of impact is therefore tied to the permissions and available resources of the specific worker. In environments where a worker communicates with internal services or handles secrets and data, this is a reason to conduct a more thorough compromise assessment after updating.
Additional information may come from public indicators of compromise, detection rules or more detailed forensic and configuration recommendations from Kestra. For now, the immediately confirmed steps are to deploy the fixed release and check for suspicious workflows or worker activity.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms CVE-2026-49869 was added to KEV on September 2, 2026, the September 5 deadline and documented exploitation.
- GitHub Security Advisory GHSA-5vc5-wxxq-3fjx – Describes the authentication flaw, the possibility of unauthenticated workflow execution and fixed versions 1.0.45 and 1.3.21.
- NVD CVE-2026-49869 – Confirms the CVE identifier, affected versions and the technical impact, including remote code execution.
- Microsoft Security Blog – Provides an independent analysis of the compromise, in which Microsoft assesses exploitation of CVE-2026-49869 as likely initial access.
Verified and updated: 09/03/2026 06:25
