CVE-2026-49869

COMPONENT VERSION RANGE

NewScan fingerprints Kestra from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-03 (KEV, CVSS 10.0). Version-gated on the tech_signatures "Kestra" fingerprint and its /api/v1/configs version_from - the SAME anonymous main-port endpoint the CVE abuses (measured 2026-08-23: /api/v1/configs -> 200 {"version":"1.3.34",...}), so the observation source is proven. GHSA-5vc5-wxxq-3fjx: AuthenticationFilter whitelists any path whose final segment is `configs` via request.getPath().endsWith("/configs") instead of an exact match, so an unauthenticated request to any endpoint ending in /configs bypasses auth entirely - enough to create+execute a workflow with shell/Python tasks, i.e. unauthenticated RCE as root in the worker container, plus SSRF and cloud-credential theft. TWO rows for the two maintained branches so a patched build is never flagged: this row is the 1.0.x LTS line (fixed 1.0.45), the sibling row is 1.1.0-1.3.20 (fixed 1.3.21). Affected <=1.3.20; our measured 1.3.34 sorts above both fixes and correctly matches neither. Version-match advisory: the scanner does not send the bypass request, it reads the anonymous version and tells the operator to patch.

COMPONENT VERSION RANGE

NewScan fingerprints Kestra from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-03. The 1.1.0-1.3.20 branch of CVE-2026-49869 (fixed 1.3.21); the 1.0.x LTS half is the sibling row (fixed 1.0.45). Split into two disjoint ranges because 1.0.45 (patched on the 1.0 line) sorts BELOW 1.3.21 and a single lt:1.3.21 range would call it vulnerable - a false positive on a patched install. See the sibling row's note for the mechanism and the proven /api/v1/configs version source.