HIGH CISA-KEV ACTIVELY EXPLOITED

CVE-2026-49869

Kestra OSS OS Command Injection Vulnerability

Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.

Affected Products

Kestra: Kestra OSS

References

Published: 2026-09-02 · Source: CISA-KEV · Feed updated: 2026-09-02

This high severity vulnerability was published on 2026-09-02 via CISA-KEV. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. Affected: Kestra: Kestra OSS.

Risk Timeline

CVE Disclosed2026-09-02 · 0 days ago

CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity

Remediation Resources

CISA / KEV

www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2026-49869

vulnfeed aggregates 10363 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.