Urgent.News

What's breaking now, across thousands of outlets.

Monday, 12 October 2026 Reading Room

Tech

CVE-2026-49869 Explained: How One String Comparison Hands Root to an Unauthenticated Attacker

Overview Item Detail CVE ID CVE-2026-49869 Affected product Kestra OSS (open-source workflow orchestration platform) Affected versions Below 1.0.45, and 1.1.0 up to (not including) 1.3.21 Fixed in 1.0.45, 1.3.21 CVSS 3.1 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Type CWE-287 (Improper Authentication), CWE-184 (Incomplete List of Disallowed Inputs), CWE-78 (OS Command Injection),…

dev.to ·

CVE-2026-49869 is a critical vulnerability affecting Kestra OSS, an open-source workflow orchestration platform. The flaw enables an unauthenticated attacker to gain root access to the system. This occurs due to an improper authentication check in the AuthenticationFilter. Instead of verifying if the request path is the exact configuration endpoint, the code checks if the path ends with "/configs".

This allows an attacker to create a flow named "configs" with a shell execution plugin, which will then execute with root privileges upon triggering the flow. The vulnerability is present in versions below 1.0.45, and 1.1.0 up to (but not including) 1.3.21, and is fixed in subsequent releases.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

What Should a Software Architecture Assessment Include?

A software architecture assessment should help leadership make decisions. It should not be a generic audit, a tooling checklist or a long document that nobody uses.

  • A software architecture assessment clarifies current system, risk areas, and essential changes.
  • It connects technical changes to business outcomes for actionable roadmaps.
  • Independent assessments provide evidence-based insights beyond internal judgment.

·dev.to

Learning to Fit the Room: A Skill I Built to Practice Concision

How working on my own communication led me to build Concision, a portable skill for AI agents. I’ve received the same kind of feedback more than once at work: I can go too far into detail when I…

  • Developed "Concision" SKILL.md to help AI agents edit messages concisely.
  • Demonstrated effectiveness with performance pilot showing 510 ms latency drop.
  • Created audience-specific drafts for engineering, product, and management.

·dev.to

When Does Your Business Need a Software Architecture Review?

A software architecture review is not an academic exercise. It is a business tool for understanding whether the system can support the next stage of growth, product change, compliance pressure or…

  • Conduct review before system issues arise, not after outages or cost escalations
  • Identify unified technical and business perspective among engineering leaders
  • Review outcomes include architecture map, risk register, action plan, and roadmap

·dev.to

Khoj: Step Outside With a Question, Come Back With a Story

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass Khoj (खोज) — Don't Follow the Map. Follow Your Curiosity.

  • Khoj turns city walks into curiosity-driven adventures.
  • App encourages users to engage with the world around them.
  • Offline-first functionality works without reliable connectivity.

·dev.to

More from Monday 12 October →