ZeroDayAlert

CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

Kestra Kestra OSS Added to KEV 2026-09-02 Federal due 2026-09-05 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Kestra OSS is an open-source workflow orchestration platform. The vulnerability allows unauthenticated remote attackers to inject arbitrary OS commands and create workflows without valid credentials. If you run Kestra OSS—whether on-premises, in a container environment, or in the cloud—and it is reachable over the network, you may be exposed.

How to check whether this touches you

  • Search your infrastructure inventory (configuration management database, asset register, or container image registry) for any deployment or service named Kestra or Kestra OSS.
  • Confirm whether the instance is reachable from the internet, an untrusted network, or from user workstations. Check firewall rules, network segmentation, and any reverse proxy or API gateway in front of it.
  • Note the running version of Kestra OSS. Vendor security advisories and release notes will specify which versions are vulnerable and which contain fixes; version strings in HTTP headers or the admin interface are a starting signal but do not confirm patching status, since backported fixes may exist in older version lines.
  • Check application logs and access logs for POST or GET requests to workflow creation or execution endpoints from unfamiliar sources, particularly before the advisory publication date.

What to do

  1. Immediately check the official Kestra security advisory and vendor guidance for the specific remediation steps and patched version numbers. Apply the vendor's fix in accordance with the BOD 26-04 timeline for your asset's internet exposure category.
  2. If patching cannot be completed by the federal remediation due date and no mitigations are documented by the vendor, discontinue use of Kestra OSS or move it to an isolated, non-internet-connected environment pending a decision to replace it.
  3. In the interim, restrict network access to Kestra OSS: place it behind a firewall rule allowing only trusted source IP ranges, disable public internet routing to it, and require VPN or bastion-host access where feasible.
  4. Enable and review access logs and audit logs for the Kestra instance, paying particular attention to any workflow creation or execution events and failed authentication attempts. Configure alerting on workflow API calls from unexpected sources.
  5. If you identify evidence of exploitation, preserve logs and alert your incident response team. Treat any workflows created during the vulnerable window as untrusted and review their definitions and execution history before re-enabling them.

If you find you were exposed

Exploitation of unauthenticated command injection typically precedes public disclosure by weeks or months. Review all access logs and workflow audit trails from at least two months before the CVE publication date. Check for unexpected workflow definitions, unusual process execution on the Kestra host or worker nodes, and any lateral movement or data exfiltration. Log retention policies often constrain retrospective visibility, so prioritise preservation of audit and syslog data and involve your forensics team if you cannot rule out compromise.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-49869 is being exploited. It cannot tell you whether Kestra OSS is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →