Project
Kestra is an open-source workflow orchestration platform for building, scheduling, and automating data and business processes via YAML-defined pipelines.
Kestra's AuthenticationFilter skips authentication for any request path ending in "/configs", letting an unauthenticated attacker reach root remote code execution. Naming a flow "configs" is enough, because the REST API puts the flow name in the path. The bug is CVE-2026-49869.
Reality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
CISA added Kestra's unauthenticated code-execution flaw CVE-2026-49869, rated 10.0, to its exploited list on 2 September, three months after the fix. Orchestrators hold their workflows' credentials, so any reachable unpatched instance needs a compromise check as well as an upgrade.
Reality
CISA's exploited-vulnerability catalog now holds entries for LiteLLM, Kestra and Starlette, according to a dev.to writeup, and the quickstart docs for those tools still keep provider API keys in the process environment an attacker reads first.
Reality
Kestra's 2.0 rewrite moves user code into a data plane the platform team has to run, and it requires a migration through 1.3.x plus a changed routing default to get there, while Prefect's Dagster deal keeps its customers where they are.
Reality
The bypass is a suffix match inside Kestra's AuthenticationFilter, and the vendor fix pins the check to /api/v1/configs exactly. The two ZoomEye queries that count exposed instances disagree by nearly a factor of two.
Reality
Four years after shipping an orchestrator that wanted a Kafka cluster and an Elasticsearch cluster to schedule a job, Kestra has rebuilt the engine around that complaint, keeping the Apache 2.0 licence in place.
Reality
Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality