Kestra OSS OS Command Injection (CVE-2026-49869)

Catalog analysis: CISA added this entry on September 02, 2026. The entry reflects catalog information retrieved on September 02, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-49869 is an OS command injection vulnerability affecting Kestra OSS. The flaw enables an unauthenticated remote attacker to bypass credential requirements to create and execute arbitrary workflows on the target system. This vulnerability is associated with several common weakness enumerations, including CWE-78 (OS Command Injection), CWE-184 (Improper Neutralization of Special Elements), CWE-287 (Improper Authentication), and CWE-918 (Server-Side Request Forgery).

Exposure and applicability

This vulnerability applies to organizations deploying Kestra OSS. Because the flaw allows for unauthenticated remote access, assets exposed to the public internet or untrusted network segments are at the highest risk. Infrastructure owners should identify all instances of Kestra OSS within their environment to determine the scope of exposure.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities catalog, remediation should be prioritized as a critical task. Our analysis suggests the following priority sequence:

1. Immediate Mitigation: Apply all mitigations provided by the vendor. For those utilizing cloud services, specific BOD 26-04 guidance regarding cloud service providers should be reviewed.
2. Forensic Triage: Because this vulnerability is flagged for forensic triage, defenders should examine logs and system state for evidence of unauthorized workflow creation or execution before and after patching.
3. Exposure Reduction: Evaluate the network placement of Kestra OSS assets. Restricting access to trusted internal networks could reduce the likelihood of exploitation by unauthenticated remote actors while patches are being deployed.
4. Decommissioning: If vendor mitigations are unavailable or cannot be applied, the product should be discontinued to eliminate the risk.

How to validate remediation

Verification must go beyond a simple version check. To ensure that exposure has been reduced, defenders should perform the following:

• Configuration Audit: Verify that the specific vendor-recommended mitigation steps have been implemented and are active in the environment.
• Access Testing: Attempt to create or execute a workflow without credentials from an external network position (where authorized) to confirm that unauthenticated remote access is blocked.
• Log Review: Monitor for failed attempts to trigger the vulnerability, which can provide evidence that the mitigation is actively rejecting unauthorized requests.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Additionally, while vendor mitigations are the primary path to resolution, there may be residual risk if the underlying environment allows for lateral movement once a workflow is executed. Defenders should consider the potential for post-exploitation activity even after the initial entry point is closed.

Source and editorial note

CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability · Source date: September 02, 2026 · Retrieved September 02, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment