Quick answers
- Is CVE-2026-49869 exploited in the wild?
- Yes. CVE-2026-49869 is known to be exploited in the wild, first recorded on 2 September 2026. Treat it as urgent.
- How severe is CVE-2026-49869?
- Critical severity, with a CVSS score of 10, published 26 June 2026.
- Which products and versions are affected?
- Kestra OSS < 1.0.45, >= 1.1.0 < 1.3.21.
- Is there a fix for CVE-2026-49869?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-49869 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-49869?
- Check whether you run Kestra OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Kestra OSS contains an OS command injection vulnerability in its workflow execution component. The vulnerability stems from insufficient input validation when processing workflow definitions, allowing an attacker to inject malicious OS commands that are executed with the privileges of the Kestra process. The attack requires no authentication and can be triggered remotely via the workflow creation API. An attacker can achieve arbitrary code execution on the target system, potentially leading to lateral movement, data exfiltration, or system compromise. The vulnerability is confirmed to be actively exploited in the wild. Patch availability should be confirmed through official Kestra security advisories.
Affected products
- Kestra Kestra OSS
Timeline
- 2026-09-02: disclosed
- exploited: Confirmed exploitation in the wild