CVE-2026-49869 Kestra-Io Kestra
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a…
- CVSS
- 10.0 Critical
- EPSS
- 2.1%
- Percentile
- 82
- Published
- 2026-06-26
- Force
- 10 of 12
- Public PoC
- 2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
On CISA’s exploited list
Kestra OSS OS Command Injection Vulnerability
- Added
- 2026-09-02
- Federal patch deadline
- 2026-09-05
- Ransomware use
- not known