When an Authentication Filter Reads the URL Instead of the Route: Lessons from CVE-2026-49869 in Kestra

A workflow orchestrator is not a content site. It schedules jobs, runs shell and Python tasks, reaches databases and cloud APIs, and stores the credentials it needs to do all of that. When an authentication check in front of that platform can be walked around, the consequence is not a leaked configuration page. It is code execution inside the worker that runs the jobs.
CVE-2026-49869 is a clean example of that failure mode, and it is worth studying because the underlying mistake is small, common, and easy to repeat in any service that exposes a public endpoint next to protected ones.

The flaw in one line

The vulnerable code lived in Kestra's AuthenticationFilter. To let the login and initialization flow read a public configuration endpoint, the filter skipped Basic Authentication for any request whose path ended with the string /configs:

if (request.getPath().endsWith("/configs")) {
    return next();
}

The intent was to exempt one fixed endpoint. The implementation exempted every path that happens to end with the same characters. In Kestra, configs is not reserved to that one route. It can also appear as a caller-controlled resource identifier in other API paths, including the endpoints that create and execute flows. An unauthenticated request to a path such as a flow or execution route ending in /configs therefore satisfied the suffix test and skipped authentication.
Kestra ships script execution plugins by default. Once an anonymous caller can create a flow and trigger it, the platform's own legitimate capability — running shell, Python, or Node.js tasks — becomes the attacker's execution primitive. The vendor advisory rates the issue Critical with a CVSS 3.1 base score of 10.0 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: reachable over the network, low complexity, no privileges, no user interaction, and high impact across confidentiality, integrity, and availability.

Why an authentication bypass becomes remote code execution

On a blog, an authentication bypass might mean editing someone else's draft. On a workflow orchestrator, the platform's normal job is to execute code. Kestra's documented responsibilities include defining and scheduling workflows, running script tasks in several languages, connecting to databases, cloud services, message systems, and internal APIs, and persisting flow configuration, variables, and run logs.
That produces a short chain:

1. A path suffix is misread as proof of identity.
2. Basic Authentication is skipped for a protected route.
3. The anonymous caller creates a workflow.
4. The caller triggers that workflow.
5. The workflow runs a script task inside the worker boundary. No separate command-injection bug is required. The orchestrator already offers controlled code execution; the flaw only removes the authentication that was supposed to guard it. Security researchers describe this pattern as capability amplification: a low-level authorization error is magnified by a high-level business feature. ## What the fix changed The vendor's fix commit (2475839) normalizes the request path first and then matches the public configuration endpoint exactly as /api/v1/configs, instead of testing a suffix. The same commit adds negative regression tests asserting that other API paths ending in /configs still return 401 Unauthorized. That is the durable lesson. An authorization decision should be tied to the identity of the route as the router understands it, not to the text of the path as the filter sees it. When a CDN, a WAF, a reverse proxy, an API gateway, a framework filter, and a business router each apply their own string rules to decide "what endpoint is this," the security boundary will eventually disagree with the routing layer, and the gap is exploitable. ## Practical implications for operators The affected versions are Kestra OSS up to and including 1.3.20, with CVE data also expressed as < 1.0.45 and >= 1.1.0, < 1.3.21. Fixed releases are 1.0.45 and 1.3.21. CISA added CVE-2026-49869 to the Known Exploited Vulnerabilities catalog on 2026-09-02, which means there is evidence of real-world exploitation, not just a theoretical audit finding. Concrete steps:
6. Upgrade to 1.0.45, 1.3.21, or a later supported release.
7. Until the upgrade lands, restrict the Kestra API at the network layer so only trusted administrative entry points can reach it, and enforce authentication at the upstream proxy rather than relying on the application filter alone.
8. Do not stop at version scanning. Review for unexpected flows, unfamiliar executions, key-value changes, deleted logs, and script tasks from unknown sources. If the instance could reach cloud metadata endpoints, database credentials, or internal APIs, treat credential rotation as part of the response.
9. Assume the blast radius extends past Kestra itself if the worker can reach a database, object storage, a message queue, a code repository, or cloud credentials. Two claims deserve caution. "Root inside the container" is not automatically "root on the host"; escaping the container boundary depends on mounts, capabilities, exposed sockets, service accounts, and runtime configuration. And CISA confirming exploitation does not mean every internet-facing instance was compromised, nor did the KEV entry publish full campaign details. ## The general rule The specific string is not the lesson. The lesson is that a security policy must match the true identity of a route. A suffix comparison, a startsWith check, a regex that tolerates extra segments, or a normalization step that runs in one layer but not another will all produce the same class of bug. Where a platform can execute code, reach secrets, or touch other systems, that class of bug is not a configuration nuisance. It is remote code execution waiting for a caller. ## References
10. Kestra GitHub Security Advisory GHSA-5vc5-wxxq-3fjx (CVE-2026-49869), including the fix commit 2475839.
11. CISA, "CISA Adds Seven Known Exploited Vulnerabilities to Catalog," 2026-09-02.
12. CVE-2026-49869 record, CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
13. iThome, "CISA warns of exploitation of known vulnerabilities in SonicWall, JFrog Artifactory, LiteLLM and others," 2026-09-03.