The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CVE-2026-49869 is a critical authentication bypass in Kestra OSS. Its authentication filter exempted requests by checking whether the URL path ended in /configs, not whether it matched a specific public route. According to Kestra’s GitHub security advisory, published June 3, 2026, that suffix check let unauthenticated requests reach API routes well beyond the one configuration endpoint that was meant to be public, with consequences the advisory describes as workflow creation and execution without credentials.
What the flaw was
Kestra OSS uses an AuthenticationFilter to decide which requests need Basic Auth. According to the advisory, the filter used request.getPath().endsWith("/configs") to exempt a configuration endpoint from authentication. The endpoints that were meant to be public were GET /api/v1/configs and GET /api/v1/{tenant}/configs.
The problem is the comparison operator. An exemption for two exact paths becomes an exemption for any path whose last segment is configs. Every other API route with that final segment also skipped the authentication check. The advisory does not enumerate those routes, so operators should treat the whole family of configs-suffixed paths as in scope rather than checking a short list.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsExact matching versus suffix matching
The difference is easiest to see side by side. The table below compares how the filter should have decided with how the advisory says it decided.
#1 Best Overall
| Question the filter asks | Intended behavior (exact route match) | Behavior described in the advisory (suffix match) |
|---|---|---|
Is GET /api/v1/configs public? |
Yes | Yes |
Is GET /api/v1/{tenant}/configs public? |
Yes | Yes |
Is any other API path whose final segment is configs public? |
No, it requires credentials | Yes, it bypasses Basic Auth |
| What does the filter compare? | The full route, method and path shape | The end of the URL string |
Route-based authorization normally checks a known set of endpoints, usually with a method and a path pattern. A string suffix check ignores everything before the final segment, so the set of exempted routes grows whenever a new endpoint happens to end in the same word.
What the advisory says an attacker could do
The advisory describes impacts in its own setup. They are not presented as results reproduced across every deployment.
Unauthenticated workflow creation and execution
The advisory’s central claim is that an unauthenticated remote attacker can create and execute workflows named configs. Its quoted statement reads: “An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials.”
Command execution in the worker container
The advisory says Kestra’s script execution plugins are installed by default in the described setup. In that setup, a workflow run could execute commands as root inside the worker container. This is container-level execution. The advisory states that a direct escape through the Docker socket was not confirmed, so it does not establish host root access or a cloud-account compromise. Those outcomes should not be assumed from this advisory alone.
Server-side request forgery and operations on configs resources
The advisory also describes server-side request forgery against internal services, along with unauthorized operations on resources named configs. These are listed as reported impacts. Whether they apply to a given deployment depends on what internal services are reachable from the worker and what resources exist.
Affected and fixed versions
The advisory identifies the affected range and fixed releases as follows.
| Release state | Versions named in the advisory | Notes |
|---|---|---|
| Affected | Through 1.3.20 | Kestra OSS with Basic Auth. The advisory’s proof-of-concept was run against v1.3.20. |
| Patched | 1.0.45 | Fixed release named for the 1.0.x line. |
| Patched | 1.3.21 | Fixed release named for the 1.3.x line. |
| Other branches | Not stated in the advisory | Confirm with the advisory and your vendor support channel before assuming coverage. |
The advisory’s proof-of-concept testing was done by the vendor against v1.3.20. The article does not rely on independent testing of this flaw.
Does internet exposure matter?
No. The advisory says public internet exposure is not required. If an attacker can reach the Kestra service port over any network path, such as an internal corporate network, a VPN, or a cluster-internal route, the advisory treats that as sufficient. Basic Auth deployments of Kestra OSS are the configuration the advisory identifies as affected, and the advisory’s description includes the setting micronaut.security.enabled=false.
Best Value
Severity
The advisory rates the issue Critical, with a CVSS v3.1 base score of 10.0 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Read in plain terms, the vector says the attack is over the network (AV:N), requires low complexity (AC:L), needs no privileges (PR:N) or user interaction (UI:N), and changes the security scope (S:C). It rates confidentiality, integrity and availability impact as high. These values are the advisory’s own assessment.
What to verify and do
- Identify the deployed version. Check the Kestra image tag or package version in your deployment manifest or container runtime. If it is 1.3.20 or earlier in the affected range, treat the instance as vulnerable until it is upgraded.
- Confirm the authentication configuration. Check whether the instance runs Kestra OSS with Basic Auth and whether
micronaut.security.enabled=falseappears in its configuration, as the advisory describes. - Confirm network reachability. Determine which networks can reach the Kestra service port. Internal reachability is enough to be exposed, so the answer should not be limited to the public internet.
- Upgrade to a fixed release on your branch. For the 1.0.x line, the advisory names 1.0.45. For the 1.3.x line, it names 1.3.21. If you run another branch, confirm the correct target with the advisory or vendor support before you upgrade.
- Review workflows and logs for unexpected activity. Look for workflows named
configsthat nobody on your team created, unexpected executions, and unusual outbound requests from workers. If you find any, follow your incident response process and treat the worker environment as potentially compromised.
Lessons for route-based authorization
The general lesson is that an authorization exemption should name the exact routes it covers. A suffix, prefix or substring check silently widens the exemption whenever a new endpoint shares that pattern. Where a framework supports route-level annotations or per-endpoint security rules, use them instead of comparing raw path strings. Tests for authorization should include negative cases: requests to similar paths that should still require credentials. Those cases would have caught this kind of widening before release.
What is and is not established
The advisory is the primary source for every claim in this article. It establishes the root cause, the affected and fixed versions, the reported impacts, and the CVSS rating. It does not establish how many deployments are exposed, and it does not provide a list of every route that was affected. The article has not verified these claims independently, and readers should rely on Kestra’s current advisory and release notes, since patch and support status can change after publication.
Recommended Free Tools
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
