THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-49869 (CRITICAL 10.0) — Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather tha

[NVD] CVE-2026-49869 (CRITICAL 10.0) — Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather tha

lownvdPublished 2026-06-26

CVE-2026-49869 CVSS: 10.0 CRITICAL Published: 2026-06-26T22:16:32.113

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last se

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-49869cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-49869