CVE-2026-49869 — Kestra Kestra OSS: Kestra OSS OS Command Injection Vulnerability

1. Executive summary

CVE-2026-49869 is an OS command injection vulnerability (CVSS 10.0 CRITICAL, CWE-78) in Kestra OSS, an open-source workflow orchestration platform. The flaw allows an unauthenticated remote attacker to create and execute arbitrary workflows without credentials — effectively pre-authentication remote code execution on any internet-exposed instance. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 2026-09-02, with a federal remediation due date of 2026-09-05; EPSS currently sits at 1%, which we assess as lagging real-world risk given confirmed KEV listing. Any EMEA financial services organisation running Kestra OSS — including instances embedded in data-engineering or MLOps toolchains — should treat internet-exposed deployments as presumptively compromised and act immediately.

2. Regulatory framing

No specific UK NIS 2018 obligation is directly engaged beyond standard OES/RDSP duties, as nothing in this item indicates a UK-specific trigger fact.

3. Technical analysis & attack chain

Vulnerability mechanism. Kestra OSS contains an OS command injection flaw (CWE-78; NVD also records CWE-184, incomplete list of disallowed inputs — both classifications describe the same missing-input-validation defect). The vulnerability permits an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. In a workflow orchestration platform, the ability to create and trigger a workflow is functionally equivalent to arbitrary code execution: workflows execute tasks, and task definitions can invoke shell commands, scripts, and plugins on the worker host. The attacker therefore does not need a separate payload-delivery primitive — the platform's own execution engine is the payload mechanism.

Confirmed attack chain (per CISA KEV entry)

1. Initial access. Attacker reaches an exposed Kestra OSS instance (web UI/API) over the network. No authentication is required.
2. Exploitation. Attacker submits crafted input that is passed unsanitised to OS command execution (CWE-78), or creates a malicious workflow via the unauthenticated workflow-creation path.
3. Execution. The crafted workflow or injected command executes on the Kestra host with the privileges of the Kestra service account.
4. Post-exploitation. Arbitrary workflows can be created and executed repeatedly, giving the attacker a durable, platform-native execution primitive without needing to install additional tooling.

What the source does not establish. The CISA KEV entry confirms the vulnerability is known to be exploited but provides no detail on attacker identity, exploitation tooling, observed post-exploitation behaviour, persistence mechanisms, C2 infrastructure, or data exfiltration. No ransomware campaign use is recorded ("Known ransomware campaign use: Unknown"). No MITRE ATT&CK actor profile exists in the verified reference data; accordingly, attribution is unconfirmed and no actor should be assumed. Exploitation detail beyond the KEV listing is single-sourced (CISA); no vendor advisory or third-party technical write-up was available in the source material at time of writing.

Context from related KEV entries. This addition continues a sustained pattern of CISA KEV additions for unauthenticated command-injection flaws in infrastructure and orchestration products during July–September 2026 (Synacor ZCS CVE-2026-73570, IBM Langflow CVE-2026-9198, Arista VeloCloud Orchestrator CVE-2026-16812, Fortinet FortiSandbox CVE-2026-25089, Progress LoadMaster CVE-2026-8037). The Langflow entry is the closest analogue: an unauthenticated code-injection flaw in a workflow/AI-orchestration platform yielding full RCE on default deployments. The pattern indicates active adversary interest in orchestration-layer pre-auth RCE as an initial-access vector.

4. Mitigation & containment

P1 — within 24 hours

• Inventory. Locate all Kestra OSS instances — including self-hosted, containerised, and cloud deployments — across production, DR, and development estates. Query container registries and Kubernetes namespaces for kestra/kestra images. Check for instances deployed by data-engineering or platform teams outside standard change control.
• Patch. Apply the vendor fix per vendor instructions. CISA's required action is explicit: apply mitigations in accordance with vendor instructions, in compliance with CISA BOD 26-04 prioritisation, with a due date of 2026-09-05. If mitigations are unavailable for your version, follow BOD 26-04 guidance for cloud services or discontinue use of the product.
• Contain exposure. Any instance that is (a) internet-exposed and (b) unpatched as of now should be treated as potentially compromised: isolate it from the network, preserve forensic state, and follow CISA's Forensics Triage Requirements (referenced in the KEV entry) before rebuilding.
• Block at the edge. Restrict Kestra UI/API ports at firewalls and WAFs to trusted administration networks only. No Kestra instance should be internet-reachable.

P2 — within 72 hours

• Hunt. Review Kestra instance logs for unauthenticated workflow-creation events, unexpected workflow definitions, and workflow executions initiated outside approved change windows. Inspect the host for processes spawned by the Kestra service account that do not correspond to legitimate workflow tasks.
• Rebuild exposed instances. For any instance that was internet-exposed while unpatched, rebuild from a known-good image after patching rather than in-place remediation, given the platform-native execution primitive this flaw provides.
• Verify third parties. Where Kestra OSS is operated by a vendor or SaaS provider, obtain written confirmation of patch status and exposure assessment.

P3 — within 7 days

• Harden. Enforce authentication on all Kestra deployments, remove default credentials, and place instances behind authenticated reverse proxies as a compensating control.
• Control workflow creation. Restrict who can create and execute workflows via RBAC where the deployment supports it, and alert on workflow-definition changes.
• Update TLVM scope. Add Kestra OSS to vulnerability-management scanning coverage and KEV-watchlists so future KEV additions for this product trigger automatic prioritisation.

5. Indicators of compromise

No indicators of compromise available in the source material. The CISA KEV entry provides no IOCs, and no vendor or third-party report with exploitation artefacts was available. Hunt on the behavioural basis described in §4 P2.

6. Detection

Insufficient indicators to author detection rules. The source material contains no command strings, file paths, registry keys, workflow names, or network signatures attributable to exploitation of this vulnerability. Generic detection for "Kestra process spawning shells" would be built from product behaviour assumptions, not source artefacts, and is not emitted here.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• CISA Known Exploited Vulnerabilities — CVE-2026-49869 — Kestra OSS OS Command Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-49869 — 2026-09-01
• NVD — CVE-2026-49869 — https://nvd.nist.gov/vuln/detail/CVE-2026-49869 — 2026-09-01
• CISA KEV (context) — CVE-2026-9198 — IBM Langflow Code Injection — https://nvd.nist.gov/vuln/detail/CVE-2026-9198 — 2026-08-07
• CISA KEV (context) — CVE-2026-73570 — Synacor ZCS OS Command Injection — https://nvd.nist.gov/vuln/detail/CVE-2026-73570 — 2026-08-24
• CISA KEV (context) — CVE-2026-16812 — Arista VeloCloud Orchestrator On-Prem OS Command Injection — https://nvd.nist.gov/vuln/detail/CVE-2026-16812 — 2026-07-30
• CISA KEV (context) — CVE-2026-25089 — Fortinet FortiSandbox OS Command Injection — https://nvd.nist.gov/vuln/detail/CVE-2026-25089 — 2026-07-19
• CISA KEV (context) — CVE-2026-8037 — Progress LoadMaster Command Injection — https://nvd.nist.gov/vuln/detail/CVE-2026-8037 — 2026-08-10

8. Adverse Trace position

This is a maximum-severity (CVSS 10.0 CRITICAL), KEV-listed, unauthenticated remote code execution flaw in a workflow orchestration platform, with a CISA remediation deadline of 2026-09-05 — three days from publication. The EPSS score of 1% is not a reason for delay: KEV listing is the stronger signal, and the exploitation primitive (platform-native arbitrary workflow execution) makes post-exploitation trivially persistent and difficult to distinguish from legitimate activity. Our assessment for EMEA financial services clients: exposure is likely concentrated in data-engineering and platform teams running self-hosted Kestra outside standard asset inventories, which is precisely where DORA Art. 24 testing scope and NIS2 Art. 21(2)(d) supply-chain measures should have caught it. Attribution is unconfirmed and no IOCs exist in the source material; treat any internet-exposed unpatched instance as compromised until forensics prove otherwise. We will monitor for vendor advisory detail, exploitation reporting, and IOC publication, and will reissue this advisory with detection content if technical write-ups emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.