ZoomEye Finds 135 Kestra Instances, 107 With HTTP After CVE Added to KEV

After CVE-2026-49869 in Kestra was added to CISA's Known Exploited Vulnerabilities catalog, ZoomEye found 135 instances of the platform, 107 of them with an observed HTTP service. The authentication bypass in the platform's AuthenticationFilter was added to KEV on 2 September 2026 with a 5 September remediation deadline.

• ZoomEye: 135 matches for app="Kestra", 107 with service="http"
• CVE-2026-49869 is an authentication bypass in Kestra's AuthenticationFilter
• Added to CISA KEV on 2 September 2026, deadline 5 September
• title="Kestra" query returned 247 matches, including docs and tutorials