Kestra OSS OS Command Injection Vulnerability

Technical Analysis

CVE-2026-49869 is an OS command injection flaw in Kestra OSS that stems from insufficient input validation, allowing an unauthenticated attacker to craft and execute malicious workflow definitions that trigger arbitrary shell command execution on the underlying host. Because Kestra is designed to orchestrate automated task pipelines, exploitation grants attackers a native mechanism to run arbitrary code with the privileges of the Kestra service, potentially leading to full host compromise, lateral movement, and data exfiltration. The lack of authentication requirement significantly lowers the barrier to exploitation, and its presence in CISA KEV confirms confirmed active exploitation. Organizations using Kestra to orchestrate AI agent pipelines, RAG data ingestion jobs, or LLM tool-calling workflows are directly exposed, since compromised orchestration hosts often store API keys, model credentials, and pipeline configuration secrets that attackers could harvest to pivot into connected AI agent infrastructure.

Affected Systems

Kestra OSS deployments (self-hosted open-source instances) running vulnerable versions prior to the patched release; specific version ranges should be confirmed via the official Kestra security advisory.

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) publicly disclosed at this time; monitor Kestra instance logs for anomalous unauthenticated workflow creation/execution requests and unexpected OS-level process spawning from the Kestra service account.

Remediation Steps

1. 1

   Patch Kestra OSS

   Upgrade to the latest patched version of Kestra OSS as specified in the vendor's security advisory addressing CVE-2026-49869.

2. 2

   Restrict network exposure

   Ensure Kestra management interfaces and APIs are not exposed to the public internet; place them behind authentication proxies, VPNs, or network segmentation.

3. 3

   Enable authentication controls

   Verify authentication and authorization are enforced for all workflow creation and execution endpoints, closing any bypass paths.

4. 4

   Audit workflow logs

   Review Kestra execution logs for unauthorized or anomalous workflow creation and execution events, especially those originating without valid credentials.

5. 5

   Rotate exposed credentials

   If compromise is suspected, rotate all API keys, service credentials, and secrets accessible to or stored within the Kestra environment, including those used by connected AI agent or LLM pipelines.

6. 6

   Apply CISA KEV deadline

   Federal agencies and organizations following CISA KEV guidance should remediate by the September 5, 2026 due date; all other organizations should prioritize immediate patching given active exploitation.