Kestra: suffix-match auth bypass on /configs gives unauthenticated workflow execution as root

Impact

AuthenticationFilter whitelists the public configuration endpoint using request.getPath().endsWith("/configs"), so any API path whose last segment happens to be configs skips Basic Auth entirely. An unauthenticated attacker can therefore create and execute arbitrary workflows, and because Kestra ships plugin-script-shell and plugin-script-python enabled by default, that is remote code execution as root inside the Kestra worker container. In a GPU shop the Kestra workers are what launch training, ETL and batch jobs, so they typically hold object-storage keys, registry credentials and cluster tokens, and are often granted host mounts or device access to reach the accelerators. CISA lists this as known exploited; the CVSS 10.0 scope-changed score reflects that the compromise does not stop at the Kestra process.

Who can reach it

Anyone who can reach the Kestra HTTP API. No credentials and no user interaction required. Exposure is limited to whoever can route to the API - a management-VLAN-only deployment is reachable by anyone on that VLAN, while an internet-exposed instance is directly exploitable.

What to do

Upgrade to Kestra 1.0.45 or 1.3.21. Cost is restarting the Kestra server and worker processes; in-flight executions are interrupted, but no node drain or reboot is involved. Because this is pre-authentication and in KEV, treat any instance that was reachable as potentially compromised: rotate the credentials the workers hold and review execution history for workflows nobody on your team created. Until the upgrade lands, remove the API from untrusted networks.

References

Related entries

• Linux crypto driver for Marvell OCTEON TX: The scatter-gather cleanup path in the Marvell OCTEON TX crypto driver usesCVE-2026-74280 · Linux crypto driver for Marvell OCTEON TXCritical
• Linux VXLAN driver (neighbour hardware address read in route_shortcircuit): `route_shortcircuit()` reads a neighbour'sCVE-2026-74475 · Linux VXLAN driver (neighbour hardware address read in route_shortcircuit)Critical
• Kubeflow Pipelines frontend (/_proxy/ route, proxy-middleware.ts): The pipelines frontend hands any unauthenticatedNCVD-2026-042-kubeflow-pipelines-frontend-prox · Kubeflow Pipelines frontend (/_proxy/ route, proxy-middleware.ts)Critical
• HTCondor (condor_credd): condor_credd can be told to create or write files as root outsideCVE-2021-25311 · HTCondor (condor_credd)Critical
• RKE / Rancher (k8s control plane): full-cluster-state configmap in kube-system readable by non-adminsCVE-2023-32191 · RKE / Rancher (k8s control plane)Critical
• VMware Aria Automation (missing access control): An authenticated user reaches remote organizations and workflows theyCVE-2023-34063 · VMware Aria Automation (missing access control)Critical