CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
| Vendor | Kestra |
|---|---|
| Product | Kestra OSS |
| Date added to KEV | 2026-09-02 |
| Due date (BOD 22-01) | 2026-09-05 |
| Known ransomware campaign use | Unknown |
| CWE | CWE-78, CWE-184, CWE-287, CWE-918 |
| Required action | Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. |
What to do
- Identify every instance of Kestra Kestra OSS in your environment (asset inventory, EDR, vulnerability scanner).
- Apply CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Federal civilian agencies must act by 2026-09-05 under BOD 22-01; other organizations can use the same date as a target.
- Check the vendor advisory and NVD entry linked below for affected versions, then record the fix in your change log.
Get new KEV entries in your inbox: free n8n workflow. Free CISA KEV Patch Digest (n8n workflow) (Runbook Foundry). A Monday-morning email of KEV entries added in the previous week (Mon-Sun), with your watchlist vendors listed first.
Not affiliated with n8n GmbH or CISA. Not tested on n8n Cloud. n8n is a trademark of n8n GmbH.
Sources
- NVD entry for CVE-2026-49869 (severity scores, if any, live there)
- CISA KEV catalog entry
- https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-49869