{"vulnerability": "CVE-2026-49869", "sightings": [{"uuid": "bd52435e-3ef5-41aa-90aa-039fd495fc64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wpquuw42c", "content": "CVE-2026-49869 - Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`\nCVE ID : CVE-2026-49869\n \n Published : June 26, 2026, 8:58 p.m. | 46\u00a0minutes ago\n \n Description : Kestra is an open-source, event-driven orchestration platform. P...", "creation_timestamp": "2026-06-26T21:55:41.631803Z"}, {"uuid": "e225e57b-239f-4315-9319-2c618c895b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7znrg3ri2v", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-49869](https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx)\nKes...\nhttps://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-06-26T22:48:16.088392Z"}, {"uuid": "599e78fb-f7b3-4100-b808-4aae4800fb81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpbwpqyb652n", "content": "\ud83d\udd34 CVE-2026-49869 - Critical (10)\n\nKestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, Authen...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49869/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-27T17:01:02.742503Z"}, {"uuid": "eff8f45e-c639-46ab-8fee-333a4c2d62f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgqbxkzns2t", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49869 \u0432 Kestra: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/B5BA2AC2-AEE2-43C7-B38D-479BC9C26EDB", "creation_timestamp": "2026-06-29T14:49:14.264859Z"}, {"uuid": "50e03134-1742-40ce-934e-29bb1cd722a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mph7jszwvg2o", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49869 \u0432 Kestra: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/83FCFA8E-72B3-469A-BC78-6B5124D0024E", "creation_timestamp": "2026-06-29T19:22:04.184884Z"}, {"uuid": "5d51b0c3-7887-406b-a45b-eebedc6b2cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mplme3jqxl2p", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-49869 \u0432 Kestra: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8374666B-B449-4CD6-8B6D-525D26AA803B", "creation_timestamp": "2026-07-01T13:22:09.249092Z"}, {"uuid": "70fbf907-33e5-4873-9d46-4130f79731df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpn2haequf2t", "content": "\ud83d\udccc CVE-2026-49869 - Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().e... https://www.cyberhub.blog/cves/CVE-2026-49869", "creation_timestamp": "2026-07-02T03:07:08.191672Z"}, {"uuid": "bcd471e3-428e-43e6-b355-6c192350e850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://t.me/GithubRedTeam/91304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49869\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ap0dexMe0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 14:53:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKestra Auth-Bypass Vulnerability Checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:16.436084Z"}, {"uuid": "af566096-140c-4efa-9e29-c33ef4eec0a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://t.me/GithubRedTeam/91304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49869\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ap0dexMe0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 14:53:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKestra Auth-Bypass Vulnerability Checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:33.020711Z"}, {"uuid": "98af1e89-8fd0-47ab-92db-cef9dde81edd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-49869\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ap0dexMe0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 14:53:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKestra Auth-Bypass Vulnerability Checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:25.368549Z"}, {"uuid": "61ea37b9-1f39-45d4-9bcd-cc466adbcddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-16T19:00:25.590335Z"}, {"uuid": "8d4db5c7-a66b-4035-8295-f1d1b9a9ae7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-16T19:00:26.029998Z"}, {"uuid": "f6ce31ab-4034-46dc-b63c-31fc9c475d9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-17T00:00:41.829799Z"}, {"uuid": "793252dd-1e8c-4c77-ae61-37171a2ea2d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-17T00:00:42.262457Z"}, {"uuid": "805b9836-8544-482a-95cc-48515d9f91ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "published-proof-of-concept", "source": "Telegram/hz8J7OmyKpCx2dwZeOGeJ4c58vtR3whLTTLekuOtA4uUGLE", "content": "", "creation_timestamp": "2026-07-18T00:00:09.137221Z"}, {"uuid": "1ed38e14-1038-49ad-ba91-2ae1a47de75c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "published-proof-of-concept", "source": "Telegram/A7idi0kvh9U61x1NsB1k_Az9Nt1DpO6JPGXo4mSDE_3-qPQ", "content": "", "creation_timestamp": "2026-07-18T00:00:09.483067Z"}, {"uuid": "c318fb72-d49e-484b-adc8-109d933d147c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukhl7mjd524", "content": "\ud83d\uded1 CVE-2026-49869\nKestra Kestra OSS\nCVSS 10.0 / EPSS 1% / KEV: No\nTL;DR: Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.2\u2026\nhttps://cvesentinel.com/report/CVE-2026-49869?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T17:29:58.530119Z"}, {"uuid": "c683880f-96b7-49b4-8d7c-b14c5641642f", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c35b7361-b19f-4856-b966-3809c4a93ad6", "content": "", "creation_timestamp": "2026-09-02T18:00:02.148418Z"}, {"uuid": "204d97d0-b0cf-4cea-a27d-e4b6c479ca15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukjsxudsw2i", "content": "\ud83d\uded1 CVE-2026-49869\nKestra Kestra OSS\nCVSS 10.0 / EPSS 1% / KEV \u2705\nTL;DR: Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21,\u2026\nhttps://cvesentinel.com/report/CVE-2026-49869?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T18:10:06.723696Z"}, {"uuid": "837fdab7-43ab-4999-b9f6-549602e790af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117202988713449046", "content": "Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.\n- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549\n- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548\n- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586\n- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329\n- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869\n- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710\n- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability", "creation_timestamp": "2026-09-02T19:01:24.604279Z"}, {"uuid": "9a7ff6b3-bd50-41d8-8d32-e07636960028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mukyxxiulz23", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-49869: Kestra OSS OS Command Injection Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-49869", "creation_timestamp": "2026-09-02T22:41:19.998702Z"}, {"uuid": "be1b7266-3f51-4c15-b266-ca834dd87a44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mulsjf56h327", "content": "Critical vulnerability CVE-2026-49869 strikes Kestra OSS with active CISA KEV exploitation. Unauthenticated attackers can execute arbitrary OS commands. Read our strategic T-Suite brief for telemetry analysis, CrowdStrike detection queries, and rapid perimeter hardening steps.\u2026", "creation_timestamp": "2026-09-03T06:18:28.315190Z"}, {"uuid": "4f528b48-25dd-462e-ac33-acd9a94c9494", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mult7vbtlp2e", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-49869: \u26a0\ufe0f CVE-2026-49869: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.0%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-49869-kestra-is-an-open-source-event-driven-orchestration", "creation_timestamp": "2026-09-03T06:31:03.324819Z"}, {"uuid": "0018d05b-daf9-4a7a-8caf-f083bb1d56ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mumtkjrgaw2c", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-49869 \u2013 Kestra OSS OS Command Injection\u00a0Vulnerability\n\nActive CISA KEV exploitation of CVE-2026-49869 exposes Kestra OSS to remote OS command injection. Explore board-ready governance, asset enumeration, and risk\u2026\n\nhttps://thecybermind.co/f58i", "creation_timestamp": "2026-09-03T16:09:40.534769Z"}, {"uuid": "d42799b6-a522-4946-ae72-e3e57630e865", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e8759eae-7c56-40c5-a594-d6c77d172beb", "content": "", "creation_timestamp": "2026-09-03T18:00:29.627567Z"}, {"uuid": "5d8c3841-1258-4f1d-b6b7-6a4e160a4eb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3muo3xzxe5k2t", "content": "Patch Kestra now: CVE-2026-49869 (CVSS 10.0) is an unauthenticated code-execution flaw under active exploitation and on CISA KEV. Upgrade to 1.0.45 or 1.3.21. https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html", "creation_timestamp": "2026-09-04T04:13:02.666475Z"}, {"uuid": "27f85d10-0c31-4abb-8d47-35597814ed7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49869", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muo4kovoba2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-49869: Kestra is an open-source, event-driven orchestration platform\nCVSS 10 \u00b7 EPSS 1.9% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2026-49869\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-04T04:23:28.635307Z"}]}