CVE-2026-49869 · High · CISA KEV

Kestra OSS OS Command Injection: Unauthenticated Remote Workflow Execution

Threat Engine Auto-Feed · data current as of 2026-09-03

CVE-2026-49869 is an OS command injection vulnerability in Kestra OSS, allowing an unauthenticated remote attacker to create and execute arbitrary workflows. This vulnerability is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog, indicating a high immediate risk.

  • CVSS:
  • EPSS percentile: 0.7846
  • Exploitation pressure: 72/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 78th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is an OS command injection, which occurs when an application constructs a system command using unsanitized user-supplied input. An attacker can inject malicious commands into this input, causing the application to execute them with the privileges of the application itself. In this case, it allows for the creation and execution of arbitrary workflows.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Kestra OSS for workflow automation
  • Enterprises in Financial Services and Technology sectors, given observed adversary targeting

Misconfigurations that escalate it

  • Running Kestra OSS instances with default or insecure configurations
  • Lack of network segmentation for Kestra OSS deployments

High-impact scenarios

  • Complete system compromise through arbitrary command execution
  • Data exfiltration or modification via unauthorized workflow execution
  • Disruption of critical business processes managed by Kestra OSS workflows
  • Establishment of persistent access within the environment

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Kestra OSS logs for unusual workflow creation or execution activities from unknown sources
  • Implement network intrusion detection systems (NIDS) to flag suspicious traffic patterns to Kestra OSS instances
  • Regularly scan Kestra OSS deployments for known vulnerabilities

Contain

  • Isolate affected Kestra OSS instances from the network to prevent further compromise
  • Block all unauthorized external access to Kestra OSS instances at the network perimeter

Patch

  • Apply vendor-provided patches for Kestra OSS immediately upon availability

Frontier verdict — High

This is a critical vulnerability due to unauthenticated remote OS command injection, active exploitation in the wild (CISA KEV), and high EPSS, demanding immediate attention.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.