CVE-2026-49869

CRITICAL CISA KEV

ACT NOW Priority: 0.21 BB Relevance: 80/100

Published: 2026-06-26 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: None

S: Changed

C: High

I: High

A: High

Description

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

CISA Known Exploited Vulnerability

Vendor / Product Kestra — Kestra OSS

Date Added 2026-09-02

Remediation Due 2026-09-05

This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-49869