135 Kestra Matches and 107 With HTTP: Reading Workflow Orchestrator Exposure Honestly

When a workflow orchestrator is added to the CISA Known Exploited Vulnerabilities catalog, the first question most teams ask is how many instances are exposed. The honest answer requires more than one number, because different queries measure different things. This article walks through what ZoomEye shows for Kestra and what those figures do and do not tell you.

Why Kestra is worth measuring

Kestra is an event-driven orchestration platform for data, AI and infrastructure workflows. It runs shell, Python and Node.js tasks, connects to databases, cloud services and internal APIs, and stores configuration and run logs. CVE-2026-49869, an authentication bypass in the platform's AuthenticationFilter, was added to KEV on 2 September 2026 with a federal remediation deadline of 5 September.

That combination, a platform that executes code by design plus an authentication bypass, is what makes the exposure question meaningful rather than academic.

What the queries return

Two queries were run at the same time, and the difference between them is instructive.

Query	Matches
app="Kestra"	135
app="Kestra" && service="http"	107
title="Kestra"	247

The app fingerprint identifies instances ZoomEye recognises as Kestra through its detection rules. The service="http" filter narrows that to instances where an HTTP service was observed. The title query matches pages whose HTML title contains the string, which is a broader and noisier signal: it can include documentation sites, tutorials and unrelated pages that mention the product.

That is why the title count is higher. It is not a better measure of running instances. It is a different measure of a different thing.

What the numbers mean, and what they do not

The 107 figure is the most useful starting point for exposure assessment, because it requires both a product fingerprint and an observed HTTP service. But it should not be read as "107 vulnerable instances." Several caveats apply:

• Fingerprint coverage is not complete. An instance behind a reverse proxy, on a non-standard port, or with a modified response may not match the fingerprint.
• Version is not part of the query. A matched instance may be patched.
• Reachability is not the same as exploitability. An instance may be behind authentication at a network layer, or reachable only from a restricted range.
• Scan timing matters. ZoomEye data reflects the time of collection, not the current moment.

The useful interpretation is directional: Kestra is a low-volume, high-privilege platform. A count in the low hundreds is small compared to general-purpose web servers, and that is precisely why each exposed instance deserves individual attention rather than statistical treatment.

A practical method

For a platform like this, the productive workflow is:

1. Use the combined query as a discovery baseline. app="Kestra" && service="http" gives a defensible starting set.
2. Compare against your own inventory. The external count is only useful as a cross-check on what you believe you own.
3. Verify version and configuration on each match you own. Fingerprint match is not version detection.
4. Record the query, the collection time and the scope alongside the number. A count without its query is not reproducible.
5. Re-run periodically. The value of an exposure baseline comes from the trend, not a single reading.

The broader point

Workflow orchestrators, AI gateways and CI systems share a characteristic: they are introduced by engineering teams for operational reasons, and they frequently do not appear in a security asset register. The external measurement is a way to find the ones nobody wrote down.

That is the honest use of a number like 107. It is not a risk score. It is a prompt to go and check whether any of them are yours.

References

• ZoomEye search results for app="Kestra", app="Kestra" && service="http" and title="Kestra", collected 23 September 2026
• Kestra GitHub Security Advisory GHSA-5vc5-wxxq-3fjx for CVE-2026-49869
• CISA Known Exploited Vulnerabilities Catalog, Kestra entry added 2 September 2026
• NVD entry for CVE-2026-49869