Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-49869
By Stav Salman |
27 June 2026
CVE-2026-49869 – Kestra OSS auth bypass on `/configs` suffix enables unauthenticated workflow execution and RCE
Kestra OSS AuthenticationFilter whitelists Basic Auth using request.getPath().endsWith(“/configs”), letting any API path ending in configs bypass auth. Affects < 1.0.45 and >= 1.1.0, < 1.3.21. Unauthenticated remote attackers can create/execute workflows; with plugin-script-shell/plugin-script-python enabled by default this yields RCE as root in the worker container. Upgrade to 1.0.45 or 1.3.21.