type: vulnerability · created: 2026-09-03 · updated: 2026-09-03 · tags: ["cve", "vulnerability", "command-injection", "kestra"] · confidence: high · severity: high · affected_sectors: ["Technology", "Government"] · au_impact: true
CVE-2026-49869
Affected product: Kestra OSS (OS command injection)
Patched version: Refer to vendor advisory
Active exploitation: Yes — added to CISA KEV catalog on 2026-09-02
Assessment
CISA added this OS command injection in Kestra OSS to its Known Exploited Vulnerabilities catalog, confirming active exploitation. Kestra is a workflow orchestration platform, and command injection in it can let an attacker execute arbitrary operating-system commands on the orchestrator host. Organisations running Kestra should prioritise patching and review exposure of the platform to untrusted input.