Vulnerability
Critical (CVSS 10.0) authentication bypass in the Kestra orchestration platform enabling unauthenticated remote code execution; in CISA's KEV catalog.
Kestra's AuthenticationFilter skips authentication for any request path ending in "/configs", letting an unauthenticated attacker reach root remote code execution. Naming a flow "configs" is enough, because the REST API puts the flow name in the path. The bug is CVE-2026-49869.
Reality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
CISA added Kestra's unauthenticated code-execution flaw CVE-2026-49869, rated 10.0, to its exploited list on 2 September, three months after the fix. Orchestrators hold their workflows' credentials, so any reachable unpatched instance needs a compromise check as well as an upgrade.
Reality
The bypass is a suffix match inside Kestra's AuthenticationFilter, and the vendor fix pins the check to /api/v1/configs exactly. The two ZoomEye queries that count exposed instances disagree by nearly a factor of two.
Reality
Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality