Meta tags:
description=Why a path-suffix authentication check in Kestra OSS turned into unauthenticated remote code execution, and what operators should do. Tagged with security, authentication, kestra, cve202649869.;
keywords=security, authentication, kestra, cve202649869, software, coding, development, engineering, inclusive, community;

Headings (most frequently used words):

the, an, authentication, from, in, when, filter, reads, url, instead, of, route, lessons, cve, 2026, 49869, kestra, dev, community, flaw, one, line, why, bypass, becomes, remote, code, execution, top, comments, more, starkman,

Text of the page (most frequently used words):
the (76), and (34), that (18), authentication (14), dev (12), 2026 (12), kestra (12), not (11), code (10), cve (10), for (8), route (8), security (7), 49869 (7), #execution (7), #filter (7), share (6), with (6), can (6), configuration (6), path (6), configs (6), create (5), one (5), from (5), cisa (5), caller (5), api (5), workflow (5), endpoint (5), when (5), community (4), other (4), identity (4), boundary (4), you (4), this (4), will (4), cvss (4), reach (4), cloud (4), suffix (4), runs (4), platform (4), script (4), tasks (4), request (4), instead (4), flow (4), software (3), database (3), your (3), bypass (3), more (3), starkman (3), abuse (3), comments (3), are (3), exploitation (3), known (3), vulnerabilities (3), including (3), fix (3), commit (3), worker (3), credentials (3), inside (3), was (3), string (3), lesson (3), layer (3), same (3), bug (3), execute (3), apis (3), orchestrator (3), public (3), skipped (3), mode (3), reads (3), url (3), lessons (3), account (2), log (2), where (2), their (2), use (2), policy (2), conduct (2), accounts (2), gateway (2), litellm (2), mcp (2), acronis (2), plugins (2), vulnerability (2), why (2), cisco (2), release (2), than (2), sep (2), hide (2), comment (2), post (2), but (2), still (2), via (2), report (2), let (2), trusted (2), user (2), vector (2), adds (2), exploited (2), catalog (2), advisory (2), 2475839 (2), message (2), root (2), container (2), service (2), mean (2), every (2), instance (2), entry (2), check (2), all (2), class (2), systems (2), remote (2), flows (2), logs (2), endpoints (2), internal (2), upgrade (2), network (2), only (2), proxy (2), controlled (2), flaw (2), capability (2), low (2), level (2), authorization (2), high (2), business (2), what (2), vendor (2), paths (2), ending (2), return (2), router (2), own (2), also (2), fixed (2), anonymous (2), basic (2), protected (2), running (2), databases (2), becomes (2), shell (2), python (2), fullscreen (2), next (2), any (2), content (2), jobs (2), copy (2), link (2), search (2), place, coders, stay, date, grow, careers, made, love, 2016, ruby, rails, built, powers, inclusive, communities, open, source, forem, terms, privacy, mlh, shop, free, postgres, contact, about, showcase, organization, advertise, help, education, tracks, videos, challenges, home, space, discuss, keep, development, manage, career, llminfrastructure, aisecurity, 87886, insecure, file, permissions, backup, cpanel, whm, plesk, cve202687886, secure, email, hardening, matters, cve202676443, 2025, joined, follow, further, actions, may, consider, blocking, person, reporting, confirm, child, well, sure, want, become, hidden, visible, permalink, dismiss, preview, submit, templates, quickly, answer, faqs, store, snippets, template, personal, subscribe, top, ithome, warns, sonicwall, jfrog, artifactory, others, record, seven, github, ghsa, 5vc5, wxxq, 3fjx, assume, blast, radius, extends, past, itself, object, storage, queue, repository, two, claims, deserve, caution, automatically, host, escaping, depends, mounts, capabilities, exposed, sockets, runtime, confirming, does, internet, facing, compromised, nor, did, kev, publish, full, campaign, details, general, rule, specific, must, match, true, comparison, regex, tolerates, extra, segments, normalization, step, another, produce, secrets, touch, nuisance, waiting, references, startswith, stop, version, scanning, review, unexpected, unfamiliar, executions, key, value, changes, deleted, unknown, sources, could, metadata, treat, credential, rotation, part, response, until, lands, restrict, administrative, points, enforce, upstream, rather, relying, application, alone, later, supported, task, separate, command, injection, required, already, offers, removes, supposed, guard, researchers, describe, pattern, amplification, error, magnified, feature, changed, normalizes, first, then, matches, exactly, testing, negative, regression, tests, asserting, durable, decision, should, tied, understands, text, sees, cdn, waf, reverse, framework, each, apply, rules, decide, eventually, disagree, routing, gap, exploitable, practical, implications, operators, affected, versions, oss, data, expressed, releases, added, which, means, there, evidence, real, world, just, theoretical, audit, finding, concrete, steps, 401, unauthorized, triggers, creates, misread, proof, blog, might, editing, someone, else, draft, normal, job, documented, responsibilities, include, defining, scheduling, workflows, several, languages, connecting, services, persisting, variables, run, produces, short, chain, intent, exempt, implementation, exempted, happens, end, characters, reserved, appear, resource, identifier, unauthenticated, such, therefore, satisfied, test, ships, default, once, trigger, legitimate, node, attacker, primitive, rates, issue, critical, base, score, reachable, over, complexity, privileges, interaction, impact, across, confidentiality, integrity, availability, exit, enter, endswith, getpath, vulnerable, lived, login, initialization, read, whose, ended, authenticationfilter, line, site, schedules, reaches, stores, needs, front, walked, around, consequence, leaked, page, clean, example, failure, worth, studying, because, underlying, mistake, small, common, easy, repeat, exposes, ones, cve202649869, posted, mastodon, facebook, linkedin, copied, clipboard, pick, gem, boost, save, jump, fire, raised, hands, exploding, head, unicorn, like, add, reaction, close, powered, algolia, navigation, menu, skip,

Text of the page (random words):
when an authentication filter reads the url instead of the route lessons from cve 2026 49869 in kestra dev community skip to content navigation menu search powered by algolia search log in create account dev community close add reaction like unicorn exploding head raised hands fire jump to comments save boost pick as gem more copy link copy link copied to clipboard share to x share to linkedin share to facebook share to mastodon share post via report abuse starkman posted on sep 16 when an authentication filter reads the url instead of the route lessons from cve 2026 49869 in kestra security authentication kestra cve202649869 when an authentication filter reads the url instead of the route lessons from cve 2026 49869 in kestra a workflow orchestrator is not a content site it schedules jobs runs shell and python tasks reaches databases and cloud apis and stores the credentials it needs to do all of that when an authentication check in front of that platform can be walked around the consequence is not a leaked configuration page it is code execution inside the worker that runs the jobs cve 2026 49869 is a clean example of that failure mode and it is worth studying because the underlying mistake is small common and easy to repeat in any service that exposes a public endpoint next to protected ones the flaw in one line the vulnerable code lived in kestra s authenticationfilter to let the login and initialization flow read a public configuration endpoint the filter skipped basic authentication for any request whose path ended with the string configs if request getpath endswith configs return next enter fullscreen mode exit fullscreen mode the intent was to exempt one fixed endpoint the implementation exempted every path that happens to end with the same characters in kestra configs is not reserved to that one route it can also appear as a caller controlled resource identifier in other api paths including the endpoints that create and execute flows an unauthenticated request to a path such as a flow or execution route ending in configs therefore satisfied the suffix test and skipped authentication kestra ships script execution plugins by default once an anonymous caller can create a flow and trigger it the platform s own legitimate capability running shell python or node js tasks becomes the attacker s execution primitive the vendor advisory rates the issue critical with a cvss 3 1 base score of 10 0 and the vector cvss 3 1 av n ac l pr n ui n s c c h i h a h reachable over the network low complexity no privileges no user interaction and high impact across confidentiality integrity and availability why an authentication bypass becomes remote code execution on a blog an authentication bypass might mean editing someone else s draft on a workflow orchestrator the platform s normal job is to execute code kestra s documented responsibilities include defining and scheduling workflows running script tasks in several languages connecting to databases cloud services message systems and internal apis and persisting flow configuration variables and run logs that produces a short chain a path suffix is misread as proof of identity basic authentication is skipped for a protected route the anonymous caller creates a workflow the caller triggers that workflow the workflow runs a script task inside the worker boundary no separate command injection bug is required the orchestrator already offers controlled code execution the flaw only removes the authentication that was supposed to guard it security researchers describe this pattern as capability amplification a low level authorization error is magnified by a high level business feature what the fix changed the vendor s fix commit 2475839 normalizes the request path first and then matches the public configuration endpoint exactly as api v1 configs instead of testing a suffix the same commit adds negative regression tests asserting that other api paths ending in configs still return 401 unauthorized that is the durable lesson an authorization decision should be tied to the identity of the route as the router understands it not to the text of the path as the filter sees it when a cdn a waf a reverse proxy an api gateway a framework filter and a business router each apply their own string rules to decide what endpoint is this the security boundary will eventually disagree with the routing layer and the gap is exploitable practical implications for operators the affected versions are kestra oss up to and including 1 3 20 with cve data also expressed as 1 0 45 and 1 1 0 1 3 21 fixed releases are 1 0 45 and 1 3 21 cisa added cve 2026 49869 to the known exploited vulnerabilities catalog on 2026 09 02 which means there is evidence of real world exploitation not just a theoretical audit finding concrete steps upgrade to 1 0 45 1 3 21 or a later supported release until the upgrade lands restrict the kestra api at the network layer so only trusted administrative entry points can reach it and enforce authentication at the upstream proxy rather than relying on the application filter alone do not stop at version scanning review for unexpected flows unfamiliar executions key value changes deleted logs and script tasks from unknown sources if the instance could reach cloud metadata endpoints database credentials or internal apis treat credential rotation as part of the response assume the blast radius extends past kestra itself if the worker can reach a database object storage a message queue a code repository or cloud credentials two claims deserve caution root inside the container is not automatically root on the host escaping the container boundary depends on mounts capabilities exposed sockets service accounts and runtime configuration and cisa confirming exploitation does not mean every internet facing instance was compromised nor did the kev entry publish full campaign details the general rule the specific string is not the lesson the lesson is that a security policy must match the true identity of a route a suffix comparison a startswith check a regex that tolerates extra segments or a normalization step that runs in one layer but not another will all produce the same class of bug where a platform can execute code reach secrets or touch other systems that class of bug is not a configuration nuisance it is remote code execution waiting for a caller references kestra github security advisory ghsa 5vc5 wxxq 3fjx cve 2026 49869 including the fix commit 2475839 cisa cisa adds seven known exploited vulnerabilities to catalog 2026 09 02 cve 2026 49869 record cvss 3 1 vector cvss 3 1 av n ac l pr n ui n s c c h i h a h ithome cisa warns of exploitation of known vulnerabilities in sonicwall jfrog artifactory litellm and others 2026 09 03 top comments 0 subscribe personal trusted user create template templates let you quickly answer faqs or store snippets for re use submit preview dismiss code of conduct report abuse are you sure you want to hide this comment it will become hidden in your post but will still be visible via the comment s permalink hide child comments as well confirm for further actions you may consider blocking this person and or reporting abuse starkman follow joined sep 16 2025 more from starkman why the cisco secure email hardening release matters more than one cve security vulnerability cisco cve202676443 cve 2026 87886 insecure file permissions in acronis backup plugins for cpanel whm and plesk security vulnerability cve202687886 acronis your ai gateway is an identity boundary the litellm mcp authentication bypass aisecurity authentication llminfrastructure mcp dev community a space to discuss and keep up software development and manage your software career home dev challenges dev videos dev education tracks dev help advertise on dev organization accounts dev showcase about contact free postgres database dev shop mlh code of conduct privacy policy terms of use built on forem the open source software that powers dev and other inclusive communities made with love and ruby on rails dev community 2016 2026 we re a place where coders share stay up to date and grow their careers log in create account