Security1 hSeptember 29, 2026, 07:20

CISA adds critical Kestra CVE-2026-49869 to KEV catalog

CISA added CVE-2026-49869 in the Kestra orchestration platform, rated 10.0, to its Known Exploited Vulnerabilities catalog. An authentication filter matched request paths by the /configs suffix instead of the exact route, allowing unauthenticated OS command injection; fixes shipped in 1.0.45 and 1.3.21 in June 2026.

DEV Community

Open source

CISA adds critical Kestra CVE-2026-49869 to KEV catalog

CVE-2026-49869 is unauthenticated OS command injection rated 10.0
Root cause: auth filter matched paths by /configs suffix, not exact route
Fixed in Kestra 1.0.45 and 1.3.21, released June 2–3, 2026
CISA listed it in KEV on September 2, 2026 after evidence of exploitation

#Kestra#CISA

Suffix Matching Is Not Authorization: Lessons from CVE-2026-49869 in Kestra

Security

Finding the Workflow Orchestrators: ZoomEye Exposure Data for Kestra After CVE-2026-49869

Security

CISA Adds Linux Kernel CVE-2026-53266 to Known Exploited Vulnerabilities Catalog

Security

CISA adds critical Kestra CVE-2026-49869 to KEV catalog

Suffix Matching Is Not Authorization: Lessons from CVE-2026-49869 in Kestra

Finding the Workflow Orchestrators: ZoomEye Exposure Data for Kestra After CVE-2026-49869

CISA Adds Linux Kernel CVE-2026-53266 to Known Exploited Vulnerabilities Catalog

CISA adds Microsoft SharePoint and MikroTik RouterOS flaws to KEV catalog