CVE-2026-49869

🎯 CVE-2026-49869 🔓 Exploited 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-49869 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.

Klassifikation & Betroffenheit:

CWE-184CWE-287CWE-78CWE-918 kestra-io kestra < 1.0.45kestra 1.1.0, < 1.3.21kestra kestra *

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

🛡️ Empfohlene Mitigation: Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you ar…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-3 · Using Leading 'Ghost' Character Sequence… (Medium) CAPEC-6 · Argument Injection (High) CAPEC-15 · Command Delimiters (High) CAPEC-43 · Exploiting Multiple Input Interpretation… (High) CAPEC-71 · Using Unicode Encoding to Bypass Validat… (High) CAPEC-73 · User-Controlled Filename (High) CAPEC-120 · Double Encoding (Medium) CAPEC-182 · Flash Injection (Medium)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-87985 10.0 CVE-2026-79696 10.0 CVE-2026-53576 10.0 CVE-2026-34612 10.0 CVE-2026-33396 10.0

🧪 Exploit-Evidenz:

🐙 Ap0dexMe0/CVE-2026-49869 🐙 EQSTLab/CVE-2026-49869

🩹 Patch verfügbar (OSV):

🩹 9225d093663e47d8e4cb3ed3969c80f7575a8817 🩹 2541c53230388d76a9acc1b43245ebce31312a88

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 06/2026

Im KEV seit 09/2026

Heute 05.11.

CVSS-Vektor-Analyse: 10.0

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CNA-Bewertung (GitHub_M): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Veröffentlicht:26.06.2026

Aktualisiert:25.10.2026 17:10

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-39922

EPSS-Verlauf (4 Messungen)

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-184 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	786	0,2 %
≥50 %	3.570	0,9 %
≥10 %	23.060	5,7 %
<10 %	380.695	93,3 %

Tier

CVEs

Anteil

≥90 %

786

0,2 %

≥50 %

3.570

0,9 %

≥10 %

23.060

5,7 %

<10 %

380.695

93,3 %

10.0 CRITICAL

EPSS

2.1%

CVE-2026-49869 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

kestra-io

CVE-2026-49869 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary

CWE-184 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 4 Monaten ↻ vor 2 Monaten

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub