Security1 hOctober 6, 2026, 23:40

CVE-2026-49869 in Kestra: internet exposure and the patch-to-KEV gap

Kestra was affected by CVE-2026-49869, an unauthenticated OS command injection rated 10.0 that allows remote code execution. The flaw was fixed in versions 1.0.45 and 1.3.21 released on 2–3 June 2026, and CISA added it to its KEV catalog on 2 September 2026. ZoomEye shows only hundreds of internet-facing instances, though most deployments are internal.

DEV Community

Open source

CVE-2026-49869 in Kestra: internet exposure and the patch-to-KEV gap

CVE-2026-49869 is an unauthenticated command injection rated 10.0
Fixed in Kestra 1.0.45 and 1.3.21 on 2–3 June 2026
CISA added the flaw to KEV on 2 September 2026
ZoomEye: 124 matches for app="Kestra", 234 for title="Kestra"

#Kestra#CISA#ZoomEye

Finding the Workflow Orchestrators: ZoomEye Exposure Data for Kestra After CVE-2026-49869

Security

Kestra CVE-2026-49869: auth bypass via /configs suffix

Security

CISA adds critical Kestra CVE-2026-49869 to KEV catalog

Security

CVE-2026-49869 in Kestra: internet exposure and the patch-to-KEV gap

Finding the Workflow Orchestrators: ZoomEye Exposure Data for Kestra After CVE-2026-49869

Kestra CVE-2026-49869: auth bypass via /configs suffix

CISA adds critical Kestra CVE-2026-49869 to KEV catalog

The AI Gateway Becomes a Target: Measuring LiteLLM and Kestra Exposure