CVE-2026-49869 in Kestra: one string check grants unauthenticated root

Kestra OSS versions below 1.0.45 and 1.1.0 up to 1.3.20 contain a CVSS 10.0 flaw: an endsWith("/configs") check in AuthenticationFilter lets attackers bypass auth by naming a flow configs. Combined with default shell plugins running as root, it yields unauthenticated remote code execution. The CVE is in CISA's KEV catalog and is being exploited, including for cryptomining.

• CVSS 3.1 score 10.0; affects Kestra below 1.0.45 and 1.1.0–1.3.20
• A flow named configs bypasses auth across all APIs
• Kestra shell plugins execute inside the worker as root
• Added to CISA KEV on Sep 2, 2026; exploited in the wild