Finding the Workflow Orchestrators: ZoomEye Exposure Data for Kestra After CVE-2026-49869

CVE-2026-49869 is an authentication bypass in Kestra OSS that escalates to unauthenticated remote code execution, rated Critical at CVSS 3.1 10.0 and added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-02. The flaw is a path-suffix check in the AuthenticationFilter: any request path ending in /configs skipped Basic Authentication, and because configs can appear as a caller-controlled resource identifier in other API routes, protected endpoints could be reached without credentials. Kestra ships script execution plugins by default, so an anonymous caller who can create and trigger a workflow can run commands inside the worker.
For defenders, the practical question is where these orchestrators live and how many are reachable. That is a measurement question, and it comes with an important caveat about how search engines fingerprint this product.

What was measured

Two ZoomEye queries were run on 2026-09-16 with scope all:

• app="Kestra" returned 119 matching assets.
• title="Kestra" returned 231 matching assets.
• app="Kestra OSS" returned 0, which indicates that this string is not a valid product fingerprint in the index rather than that no assets exist.
• vul.cve="CVE-2026-49869" returned 0, which reflects CVE indexing lag and is not evidence of patching. The two positive queries measure the same product through different signals. An app fingerprint matches the application as identified by the scanner; a title match looks at the HTML title of the page. The title count is higher here, which is common for products whose login or landing pages carry a recognizable title while the application fingerprint is narrower. Neither number should be treated as the definitive population of exposed Kestra instances, and neither should be summed with the other — they overlap. ## Reading the numbers honestly These counts describe assets that ZoomEye can identify as Kestra from the public internet. They do not tell you:
• which version each instance runs;
• whether the instance is reachable beyond the scanned port;
• whether the instance sits behind an additional authentication layer that would stop the bypass before it reaches the application filter;
• whether any instance has already been accessed. The affected versions are Kestra OSS up to and including 1.3.20, with CVE data also expressed as < 1.0.45 and >= 1.1.0, < 1.3.21. Fixed releases are 1.0.45 and 1.3.21. A public fingerprint tells you the product is there; only the owner can tell you the version and the configuration. ## Why this product class is worth measuring A workflow orchestrator is not a passive web application. Kestra's documented role is to define and schedule workflows, run shell, Python, and Node.js tasks, connect to databases, cloud services, message systems, and internal APIs, and store flow configuration, variables, and run logs. That is the point of the product, and it is also why an authentication bypass here is more than an information-disclosure issue. The exploitation chain is short. An anonymous caller creates a workflow through a route that satisfies the suffix check, triggers it, and the platform executes the script task. No separate command-injection vulnerability is needed; the orchestrator's legitimate execution capability becomes the attacker's primitive. The vendor's fix normalizes the path and matches the public configuration endpoint exactly as /api/v1/configs, and adds regression tests confirming that other paths ending in /configs return 401 Unauthorized. ## From count to action For an organization running Kestra, the useful sequence is:
• Cross-check the public fingerprint counts against your own inventory. Orchestrators are often deployed by platform or data teams and may not be in the central asset register.
• Determine which instances are reachable from untrusted networks. Even an instance that is not directly internet-facing can be exploited by an attacker who has already reached the office, development, or cluster network, so internal exposure counts too.
• Upgrade to 1.0.45, 1.3.21, or a later supported release.
• Until the upgrade lands, restrict the Kestra API at the network layer to trusted administrative entry points and enforce authentication at the upstream proxy rather than relying on the application filter.
• Investigate rather than only scan. Look for unexpected flows, unfamiliar executions, key-value changes, deleted logs, and script tasks from unknown sources. If the worker could reach cloud metadata endpoints, database credentials, or internal APIs, include credential rotation in the response.
• Be careful about the blast radius claim. Root inside the worker container is not automatically root on the host; escaping the container depends on mounts, capabilities, exposed sockets, service accounts, and runtime configuration. CISA confirming exploitation does not mean every internet-facing instance was compromised. ## What the measurement establishes The headline for Kestra is not a large number. Roughly one to two hundred publicly fingerprinted instances is a small population compared with consumer-facing products, and that is itself a useful finding: this is a component that tends to be deployed on internal networks and behind access controls, which is where it belongs. The value of the exposure query is the check against your own records — confirming whether any instance you own has a public fingerprint at all, and whether the network controls you assume are in place actually are. Where a platform can execute code and reach credentials, the exposure count is a prompt to verify configuration, not a substitute for it. ## References
• ZoomEye exposure query app="Kestra", scope all, count 119, collected 2026-09-16.
• ZoomEye exposure query title="Kestra", scope all, count 231, collected 2026-09-16.
• ZoomEye query vul.cve="CVE-2026-49869", count 0, collected 2026-09-16.
• Kestra GitHub Security Advisory GHSA-5vc5-wxxq-3fjx (CVE-2026-49869), including fix commit 2475839.
• CISA, "CISA Adds Seven Known Exploited Vulnerabilities to Catalog," 2026-09-02.
• CVE-2026-49869 record, CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.