Kestra Orchestration Platform Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2026-49869)

1. Official Patch Application

The recommended remediation is to upgrade your Kestra deployment to a patched version.

• For Kestra 1.0.x users: Upgrade to 1.0.45 or higher
• For Kestra 1.3.x users: Upgrade to 1.3.21 or higher

If you are using Docker Compose, update the image tag in your docker-compose.yml and restart the services:

services:
  kestra:
    image: kestra/kestra:v1.3.21 # or v1.0.45

2. Temporary Mitigation (Before Patching)

If an immediate upgrade is not feasible, configure a reverse proxy (e.g., Nginx) or a Web Application Firewall (WAF) to block malicious suffix-matched requests.

Nginx Mitigation Rule Example:

# Block requests where the path ends with /configs but is not the legitimate config endpoint
if ($request_uri ~* ".+/configs$") {
    return 403;
}

A critical vulnerability exists in Kestra's AuthenticationFilter where the public configuration endpoint is whitelisted using a suffix match (request.getPath().endsWith("/configs")) instead of an exact path match. Because of this implementation flaw, any API request path ending with /configs bypasses the Basic Authentication mechanism entirely.

An unauthenticated remote attacker can exploit this bypass to gain unauthorized access to the API, allowing them to create and trigger arbitrary workflows. Since Kestra ships with script execution plugins (such as plugin-script-shell and plugin-script-python) enabled by default, this vulnerability directly leads to unauthenticated Remote Code Execution (RCE) with root privileges inside the Kestra worker container. This vulnerability has been assigned a CVSS score of 10.0 and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog.