CISA Adds Kestra OSS Unauthenticated Command Injection (CVE-2026-49869) to KEV Catalog

What Happened

CISA has added CVE-2026-49869, an OS command injection vulnerability in Kestra OSS, to its Known Exploited Vulnerabilities (KEV) catalog, per Kestra's GitHub security advisory (GHSA-5vc5-wxxq-3fjx). According to the advisory, the flaw allows an unauthenticated remote attacker to create and execute arbitrary workflows without credentials, which in Kestra's architecture translates directly into OS command execution on the host running the platform. CVSS scoring and exploitation details beyond "actively exploited" have not been published in the material reviewed here; known ransomware use is currently listed as unknown.

Why It Matters

Kestra is an open-source workflow orchestration platform, and orchestration engines are high-value targets: they typically run with broad permissions to reach downstream systems (data pipelines, cloud APIs, CI/CD, infrastructure automation). An unauthenticated command injection in that context means an internet- or network-exposed Kestra OSS instance could be turned into an initial-access foothold with no credential theft required. KEV inclusion confirms CISA has evidence of in-the-wild exploitation, so this should be treated as an active threat, not a theoretical one.

What Defenders Should Do Now

• Inventory any Kestra OSS deployments, especially those reachable from the internet or from less-trusted network segments.
• Check exposure and authentication requirements on Kestra's web UI/API endpoints; unauthenticated access to workflow-creation endpoints is the core risk here.
• Review Kestra's advisory (linked below) for the affected version range and patched release, and prioritize patching or upgrading per CISA KEV remediation timelines.
• Hunt for anomalous workflow creation/execution activity in Kestra logs, particularly workflows created without a corresponding authenticated user session, and for unexpected child-process/command execution originating from the Kestra service account.
• Where patching can't happen immediately, consider restricting network access to Kestra management interfaces and monitoring outbound connections from Kestra hosts for signs of post-exploitation activity.

Developing Intel

This is a same-day KEV addition and details are still emerging; specifics on exploitation TTPs, affected version ranges, and patch guidance should be confirmed directly from the vendor advisory. See the original source: GHSA-5vc5-wxxq-3fjx.