If It Ends the Same, Let It Through" — The Comparison Operator That Broke Kestra (CVE-2026-49869)

On September 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-49869 to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, confirmed in the wild, grants root-level remote code execution (RCE) to attackers who exploit it. Federal agencies were given until September 5 to remediate the issue, as the CVSS score is a perfect 10.0, indicating critical severity.

The root cause of this vulnerability lies in a single string-comparison method call in Java: request.getPath().endsWith("/configs"). This seemingly innocuous line of code inadvertently allows attackers to manipulate the path and bypass authentication filters. The design intent behind the AuthenticationFilter in Kestra OSS was reasonable, as it provided a single API endpoint (GET /api/v1/configs) for reading base settings.

However, the flaw emerges when attempting to filter out non-config endpoints. The endsWith() method only examines the tail of a string, disregarding any preceding characters. As a result, requests such as /api/v1/main/flows/tutorial/configs and /api/v1/main/flows/configs are both treated as config endpoints, leading to unauthorized access.

Kestra's REST API embeds the caller-chosen name directly into the path, making it difficult to distinguish between legitimate and malicious requests. The vulnerability allows attackers to create a flow named "configs" containing a shell command, execute it via a POST request, and retrieve the output without any authentication. This single line of code in the AuthenticationFilter inadvertently grants attackers the ability to perform a full RCE chain, highlighting the importance of thorough code reviews and comprehensive testing.