{
  "id": 14572343,
  "title": "If It Ends the Same, Let It Through\" — The Comparison Operator That Broke Kestra (CVE-2026-49869)",
  "url": "https://urgent.news/2026/10/15/if-it-ends-the-same-let-it-through-the-comparison-operator-that-broke",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T00:32:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/guidance_white/if-it-ends-the-same-let-it-through-the-comparison-operator-that-broke-kestra-cve-2026-49869-522c"
  },
  "original_language": "en",
  "account": "On September 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-49869 to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, confirmed in the wild, grants root-level remote code execution (RCE) to attackers who exploit it. Federal agencies were given until September 5 to remediate the issue, as the CVSS score is a perfect 10.0, indicating critical severity. The root cause of this vulnerability lies in a single string-comparison method call in Java: request.getPath().endsWith(\"/configs\"). This seemingly innocuous line of code inadvertently allows attackers to manipulate the path and bypass authentication filters. The design intent behind the AuthenticationFilter in Kestra OSS was reasonable, as it provided a single API endpoint (GET /api/v1/configs) for reading base settings. However, the flaw emerges when attempting to filter out non-config endpoints. The endsWith() method only examines the tail of a string, disregarding any preceding characters. As a result, requests such as /api/v1/main/flows/tutorial/configs and /api/v1/main/flows/configs are both treated as config endpoints, leading to unauthorized access. Kestra's REST API embeds the caller-chosen name directly into the path, making it difficult to distinguish between legitimate and malicious requests. The vulnerability allows attackers to create a flow named \"configs\" containing a shell command, execute it via a POST request, and retrieve the output without any authentication. This single line of code in the AuthenticationFilter inadvertently grants attackers the ability to perform a full RCE chain, highlighting the importance of thorough code reviews and comprehensive testing.",
  "summary": "On September 2, 2026, CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities (KEV) catalog. That's not a theoretical risk — it means exploitation has been confirmed in the wild — and federal agencies were given until September 5 to remediate. The CVSS score is a perfect 10.0. And if you trace the entire incident back to its source, it comes down to a single string-comparison method call…",
  "key_points": [
    "CVE-2026-49869 added to CISA's KEV catalog on September 2, 2026",
    "Vulnerability allows root-level remote code execution (RCE)",
    "Flaw in Java's endsWith() method enables unauthorized access"
  ],
  "editors_take": "A single flawed string-comparison method transforms a standard authentication filter into a critical gateway for unauthorized remote code execution, proving how minor coding oversights can compromise entire system infrastructures.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}