Suffix Matching Is Not Authorization: Lessons from CVE-2026-49869 in Kestra
A single string comparison decided whether an HTTP request to a workflow orchestration platform needed credentials. The comparison was endsWith("/configs"). Because the platform allowed caller-controlled resource identifiers in the same URL position, any path that happened to end with those characters skipped authentication. The result, tracked as CVE-2026-49869, was rated CVSS 10.0 and added to CISA's Known Exploited Vulnerabilities catalog on 2 September 2026.
This is worth examining as an engineering lesson rather than as a single vendor incident. The same mistake appears in web applications far outside workflow tooling.
The mechanism
Kestra exposes a REST API for creating and running flows. An AuthenticationFilter protected the API with Basic Authentication but exempted a small set of public endpoints. The exemption was implemented as a suffix match: if the request path ended with /configs, the filter allowed it through.
Kestra also uses configs as a namespace or flow identifier in paths such as /api/v1/main/flows/{namespace}/{id}. An attacker could therefore name a flow configs and construct a request whose path ended with the exempted string. The filter treated the request as public.
Once past the filter, the attacker could create a flow and execute it. Kestra's script execution plugin, enabled by default, runs shell commands inside a worker container. The authentication bypass therefore became OS command injection with the privileges of that container.
Why the pattern recurs
Three properties make this class of bug common.
The check is on text, not on identity. A framework knows which route matched and which handler will run. Comparing raw path strings discards that information and replaces a structural fact with a lexical guess.
The exempted set is defined by convenience. Public endpoints are usually added one at a time, each with a quick condition. Over time the conditions accumulate and interact.
The blast radius is set by what the platform can do. A workflow engine exists to run code, reach databases, and call cloud APIs. Bypassing authentication on such a platform is not equivalent to bypassing authentication on a static page.
Detection and triage
For teams running Kestra, the useful questions are concrete.
- Which version is deployed? The advisory identifies affected ranges below 1.0.45 and within 1.1.0 through 1.3.21.
- Is the API reachable from the internet? Ports 8080 and 8006 should not be publicly exposed.
- Are there flows whose identifier is
configs, or whose namespace isconfigs? - Do execution logs contain shell commands that no team member authored?
- Were any credentials reachable from the worker container, such as cloud instance metadata or mounted secrets?
A reverse proxy rule that rejects paths ending in /configs other than the exact intended endpoint is a reasonable interim control, but it is a workaround for a code defect, not a fix.
The generalizable fix
Route-level authorization should be expressed against the route the framework actually matched. In most modern frameworks this means attaching the public/protected decision to the route definition or to a middleware that runs after routing, not to a string predicate evaluated before it.
A second habit helps: treat any endpoint that can execute code, load a plugin, or resolve a user-supplied path as an administrative surface. Those endpoints should require authentication by default, and any exemption should be an explicit, reviewed, and narrow allowance.
What to do this week
- Search the codebase for authorization logic that inspects
path,url, orendswithrather than a matched route. - List every endpoint currently exempted from authentication and confirm each one is genuinely public and read-only.
- Confirm that no exempted endpoint accepts a caller-controlled identifier in the same path position as the exemption string.
- Patch Kestra to 1.0.45 or 1.3.21 or later, matching the deployed branch.
- Review execution history for unexpected commands and rotate any credential the worker container could read.
The underlying rule is short: authorization should be a decision about a route and a caller, not about the spelling of a URL.
References
- Kestra, GitHub Security Advisory GHSA-5vc5-wxxq-3fjx (CVE-2026-49869).
- CISA, Known Exploited Vulnerabilities Catalog, 2 September 2026 update.
- Kestra documentation on authentication and API endpoints.
Limitations
This article describes the vulnerability mechanism as documented in the vendor advisory and public technical analysis. It does not include a working exploit, and the reproduction steps are limited to defensive verification. Version ranges should be confirmed against the vendor advisory for the specific branch in use.
Top comments (0)