CVE-2026-49869 CISA KEV · Actively exploitedSuited to automated attack · CISA
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
CVSS score
10.0
EPSS probability
%2.1
Risk score
0.4
Published
3 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity. The post When AI infrastructure becomes the target: Securing gateways and control points appeared first on Microsoft Security Blog.
Similar Vulnerabilities
10.0
CVE-2026-53576Code injection in Kestra
Patch status unknown Public Exploits:2EPSS %3
9.0
CVE-2026-34612SQL injection in Kestra
Patch verified Public Exploits:1EPSS %1
9.8
CVE-2026-38428SQL injection in Kestra
Patch status unknown Public Exploits:1EPSS %1
7.7
CVE-2026-49984Path traversal in Kestra
Patch status unknown Public Exploits:1EPSS %1
7.7
CVE-2026-45807Path traversal in Kestra
Patch status unknown Public Exploits:1EPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-49869"