{
  "id": 13843139,
  "title": "CVE-2026-49869 Explained: How One String Comparison Hands Root to an Unauthenticated Attacker",
  "url": "https://urgent.news/2026/10/12/cve-2026-49869-explained-how-one-string-comparison-hands-root-to-an",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-12T01:32:16.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/guidance_white/cve-2026-49869-explained-how-one-string-comparison-hands-root-to-an-unauthenticated-attacker-e35"
  },
  "original_language": "en",
  "account": "CVE-2026-49869 is a critical vulnerability affecting Kestra OSS, an open-source workflow orchestration platform. The flaw enables an unauthenticated attacker to gain root access to the system. This occurs due to an improper authentication check in the AuthenticationFilter. Instead of verifying if the request path is the exact configuration endpoint, the code checks if the path ends with \"/configs\". This allows an attacker to create a flow named \"configs\" with a shell execution plugin, which will then execute with root privileges upon triggering the flow. The vulnerability is present in versions below 1.0.45, and 1.1.0 up to (but not including) 1.3.21, and is fixed in subsequent releases.",
  "summary": "Overview Item Detail CVE ID CVE-2026-49869 Affected product Kestra OSS (open-source workflow orchestration platform) Affected versions Below 1.0.45, and 1.1.0 up to (not including) 1.3.21 Fixed in 1.0.45, 1.3.21 CVSS 3.1 10.0 (Critical) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Type CWE-287 (Improper Authentication), CWE-184 (Incomplete List of Disallowed Inputs), CWE-78 (OS Command Injection),…",
  "key_points": [
    "Critical vulnerability CVE-2026-49869 affects Kestra OSS",
    "Unauthenticated attacker gains root access via improper authentication check",
    "Fixed in Kestra OSS versions 1.0.45 and later"
  ],
  "editors_take": "Flawed path validation in the Kestra AuthenticationFilter transforms a simple naming convention into a critical security bypass that grants unauthenticated attackers full administrative control over the orchestration platform.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}