Suffix-match auth bypass in Kestra AuthenticationFilter lets unauthenticated attackers run arbitrary workflows (CVE-2026-49869)
VulnCheck added this to its known-exploited catalog yesterday and Microsoft published research tying it to in-the-wild attacks on orchestration platforms; an unpatched internet-facing Kestra instance can be taken over without credentials.
Kestra OSS whitelists its public configuration endpoint from Basic Auth using a suffix match on "/configs" instead of an exact path match, so any API path ending in that segment bypasses authentication entirely. An unauthenticated remote attacker can create and execute arbitrary workflows, and because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python) this amounts to remote code execution on the host.
Affected: Kestra < 1.0.45; Kestra >= 1.1.0, < 1.3.21
How to Test
Confirm your Kestra version is below 1.0.45 or in the 1.1.0–1.3.20 range; review API access logs for unauthenticated requests to paths whose last segment is 'configs' and for workflow creations or executions from unexpected sources.
How to Patch
Upgrade to Kestra 1.0.45 or 1.3.21 (or later); until then, remove direct internet exposure and enforce authentication at a reverse proxy in front of the Kestra API so path-suffix tricks cannot reach AuthenticationFilter unauthenticated.