A tool built to automate your workflows just became one attackers can drive without logging in. If Kestra sits anywhere in your pipeline, this is not a bug to schedule for next sprint.
The bug is a single wrong function call
Kestra OSS is an open-source workflow orchestration platform used to build and run data pipelines, ETL jobs and CI/CD automation, the kind of tool that sits at the centre of an organisation’s DevOps stack precisely because it has permission to do a lot. CVE-2026-49869, rated a maximum CVSS 10.0, exists because Kestra’s AuthenticationFilter checks whether a request path ends with /configs instead of checking for an exact match. Any API path that happens to end in those seven characters slips past authentication entirely.
That alone would be bad. What makes it critical is what an unauthenticated attacker can do once inside: create and execute arbitrary workflows with no credentials at all. Because Kestra ships with script execution plugins enabled by default, a crafted workflow gives the attacker remote code execution as root inside the Kestra worker container.
CISA’s deadline is Friday, and it applies to more than US agencies
CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on September 2, 2026, with a remediation deadline of September 5 for covered US federal organisations under its binding operational directive. Affected versions run through 1.3.20; fixes are available in 1.0.45 and 1.3.21.
A KEV listing means CISA has confirmed active exploitation, not just theoretical risk. European organisations are not bound by the US directive, but the exploitation activity behind it does not stop at a border. If your team runs Kestra to orchestrate deployments, data movement or scheduled jobs, treat the same 72-hour window CISA gave federal agencies as the realistic amount of time you have before this gets automated into opportunistic scanning.
What to check right now
Confirm your Kestra version, patch to 1.0.45 or 1.3.21, and while you’re in there, check whether the instance is reachable from the open internet at all. An orchestration platform with root-level script execution has no business being internet-facing without strong network controls in front of it, patched or not.
If your organisation runs Kestra or similar orchestration tooling and you want a proper review of what it can reach and who can reach it, contact Excello Digital. We help European DevOps teams find and close the gaps between “we deployed a useful tool” and “we deployed a tool nobody is watching.”