CVE-2026-49869: Kestra unauthenticated RCE via AuthenticationFilter path bypass
CVE-2026-49869 is verified against the affected target vulnerability class: RCE This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00247.
pruva-verify REPRO-2026-00247 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00247/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Kestra OSS before 1.0.45 and 1.3.21 has an AuthenticationFilter that uses request.getPath().endsWith('/configs') to whitelist the public configuration endpoint. This check is bypassed by sending a request to an endpoint whose path ends with '/configs', allowing unauthenticated attackers to reach internal APIs and execute arbitrary OS commands via the /api/v1/executions trigger or related flows. Reproduce: build Kestra from the source repository at a vulnerable version, start the web UI/API, then send an unauthenticated HTTP request to a path ending with '/configs' to reach an authenticated endpoint and trigger command execution.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.