Firetruck

CVE-2026-49869

KEV
Updated Sep 3, 2026 · PUBLISHED
View KEV entry →

Description

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

Full record on cve.org →

Affected packages

PackageVendor / ProductVersion rangeStatus
kestrakestra-io / kestra< 1.0.45affected
kestrakestra-io / kestra>= 1.1.0, < 1.3.21affected