CVE-2026-49869 · Kestra Authentication Bypass RCE

What happened: Kestra published GHSA-5vc5-wxxq-3fjx on June 3, 2026 for CVE-2026-49869, a Critical authentication bypass leading to unauthenticated remote code execution; on August 26, Microsoft Security Research reported an observed Kestra compromise and assessed with high confidence that this vulnerability likely provided initial access. The vulnerable OSS filter treated any API path ending in /configs as the public configuration endpoint. An attacker could therefore create or overwrite a flow named configs, trigger that flow without credentials, and use installed script tasks to execute commands as root inside the worker container. Fixed branches begin at 1.0.45 and 1.3.21.

How the observed intrusion unfolded: Microsoft saw two closely timed workflow-origin shell sessions. Follow-on commands queried a mounted Docker socket, enumerated container environment arrays, retrieved and renamed XMRig v6.26.0, enabled RandomX MSR tuning, launched the miner under nohup, and used restrictive permissions and immutable flags around temporary artifacts. A later workflow pulled script content with a curl-pipe-shell pattern, encoded collected output, and stored it through Kestra's key-value interface. Network evidence included a reverse shell to 172.232.38.92:32991 and mining traffic to auto.c3pool.org:443.

Where detection has to live: the best early signal is a Kestra or Java worker lineage spawning a shell, downloader, interpreter, or background utility; curl or wget piped directly into a shell is the strongest portable follow-on. Docker-socket discovery, MSR tuning, XMRig semantics, and permission changes add high-value corroboration. The reported IPs and pool infrastructure are recent but shared, volatile, and reassignable, so they are pivots rather than durable proof. Direct exploit-request detection remains a gap until Kestra or reverse-proxy access logs provide method, path, status, source, and authentication context. Falcon event names, fields, process ancestry, and results still require execution in the intended tenant.

Eleven current-run snapshots are hash-bound in the accompanying source manifest. Kestra/GitHub and the CVE record share one upstream disclosure group; Microsoft is an independent primary observation source.

Source ledger

Claim ledger

The hunt follows the endpoint and network consequences of unauthenticated workflow execution while preserving the actual HTTP exploit sequence as H08, an application-log gap.

Observed and assessed attack chain

Detection hypotheses

Affected surface and telemetry

Kestra OSS versions before 1.0.45 and versions 1.1.0 through 1.3.20 are affected. The endpoint coverage assumes broadly available Linux process plus IPv4/IPv6 network and DNS events. Kestra or proxy access logs, container file-open events, and a specific parser are not assumed; wrapper depth and worker/task-container lineage require tenant confirmation.

Network atomics are source-tagged and time-bounded. API routes and local artifacts are behavioral pivots, not blocklist entries.

Mappings below are analyst inferences from source-backed behavior; inventory Q01 carries no ATT&CK mapping.

No container escape technique is asserted: Microsoft observed Docker-socket access in one deployment, while the vendor advisory did not confirm a direct socket escape in its default test environment.

These hunts complement Falcon endpoint queries and are required to validate the initial access path and application context.

All query blocks are static-only designs. Choose the intended Falcon cloud, verify the repository, then run them manually before considering scheduling.

// HUNT: Kestra workload inventory
// HYPOTHESIS: H01
// USE: inventory
// MITRE: N/A — inventory
// CONF: low
// FP: medium
// COST: low
// TIMEFRAME: 30d — discover workloads before narrowing compromise windows
// REQUIRES: ProcessRollup2; aid, ComputerName, FileName, ImageFileName, CommandLine; Falcon endpoint event repository
// FALSE POSITIVES: Legitimate Kestra servers and unrelated build arguments containing the product name
// TUNING: Restrict to known server or container path conventions after validating local deployment patterns
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| (CommandLine=/kestra/i OR ImageFileName=/kestra/i OR FileName=/^kestra/i)
| table([@timestamp, aid, ComputerName, FileName, ImageFileName, CommandLine], limit=1000)

// HUNT: Kestra-origin shell and execution utility
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1059.004
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 14d — recent compromise window with bounded ancestry review
// REQUIRES: ProcessRollup2; aid, ComputerName, FileName, CommandLine, ParentBaseFileName, GrandparentBaseFileName, ParentCommandLine, ParentProcessId, TargetProcessId
// FALSE POSITIVES: Approved Kestra script tasks, worker-container troubleshooting, and legitimate automation
// TUNING: Exclude approved namespaces, worker images, and exact task command lines only after a benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| FileName=/^(bash|sh|dash|curl|wget|python|python3|nohup)$/i
| (ParentBaseFileName=/^(java|kestra)$/i OR GrandparentBaseFileName=/^(java|kestra)$/i OR ParentCommandLine=/kestra/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, GrandparentBaseFileName, ParentCommandLine, ParentProcessId, TargetProcessId], limit=1000)

// HUNT: Docker socket container environment discovery
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1613, T1552.001
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — sparse discovery behavior supports a longer retrospective
// REQUIRES: ProcessRollup2; aid, ComputerName, FileName, CommandLine, ParentBaseFileName, TargetProcessId
// FALSE POSITIVES: Approved container inventory, management agents, and platform-engineer troubleshooting
// TUNING: Exclude signed or path-pinned management agents and approved inventory command lines
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| (CommandLine="*/var/run/docker.sock*" OR CommandLine="*/containers/json*" OR CommandLine="*/containers/*/json*")
| (CommandLine="*Config.Env*" OR CommandLine="*Env*" OR CommandLine="*inspect*")
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, TargetProcessId], limit=1000)

// HUNT: Network retrieval piped directly to Unix shell
// HYPOTHESIS: H04
// USE: alert-candidate
// MITRE: T1059.004, T1105
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 14d — recent high-signal behavior with manageable administrative review
// REQUIRES: ProcessRollup2; aid, ComputerName, FileName, CommandLine, ParentBaseFileName, GrandparentBaseFileName, TargetProcessId
// FALSE POSITIVES: Bootstrap installers, cloud-init, configuration management, and developer convenience scripts
// TUNING: Exclude exact approved installer URLs and signed automation paths; do not exclude curl-pipe-shell globally
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| CommandLine=/\b(curl|wget)\b[^\r\n]{0,512}\|\s*(ba|da)?sh\b/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, GrandparentBaseFileName, TargetProcessId], limit=1000)

// HUNT: XMRig and RandomX mining preparation
// HYPOTHESIS: H05
// USE: alert-candidate
// MITRE: T1496
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — mining can persist and supports historical compromise review
// REQUIRES: ProcessRollup2; aid, ComputerName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId
// FALSE POSITIVES: Authorized cryptocurrency mining or approved RandomX performance testing
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| (CommandLine=/xmrig|randomx|stratum[+]tcp|donate-level/i OR (FileName=/^modprobe$/i AND CommandLine=/\bmsr\b.*allow_writes/i))
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId], limit=1000)

// HUNT: Reported Kestra compromise network infrastructure
// HYPOTHESIS: H06
// USE: hunt
// MITRE: T1071.001
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — recent indicators are volatile; revalidate after 2026-09-29
// REQUIRES: NetworkConnectIP4, NetworkConnectIP6, DnsRequest; aid, ComputerName, ContextBaseFileName, ContextProcessId, DomainName, RemoteAddressIP4, RemoteAddressIP6, RemotePort
// FALSE POSITIVES: Authorized mining, shared pool use, sinkholing, or later IP reassignment
// TUNING: Suppress documented authorized mining hosts and expire network indicators after revalidation
// VALIDATION: STATIC-ONLY
#event_simpleName=/^(NetworkConnectIP4|NetworkConnectIP6|DnsRequest)$/
| ((RemoteAddressIP4="172.232.38.92" AND RemotePort=32991) OR RemoteAddressIP4="47.86.197.116" OR RemoteAddressIP6="2001:41d0:701:1100::adfd" OR DomainName="auto.c3pool.org")
| table([@timestamp, aid, ComputerName, ContextBaseFileName, ContextProcessId, DomainName, RemoteAddressIP4, RemoteAddressIP6, RemotePort], limit=1000)

// HUNT: Temporary-path permissions and immutable-flag changes
// HYPOTHESIS: H07
// USE: hunt
// MITRE: T1222.002
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — rare behavior supports historical review
// REQUIRES: ProcessRollup2; aid, ComputerName, FileName, CommandLine, ParentBaseFileName, TargetProcessId
// FALSE POSITIVES: Hardening scripts, backup tools, and package installers manipulating temporary files
// TUNING: Exclude exact approved automation paths and service accounts after reviewing surrounding process lineage
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| FileName=/^(chattr|chmod)$/i
| CommandLine=/(\+i|(^|\s)[04][0-7]{2,3}\s).*(\/tmp\/|\/var\/tmp\/|\/dev\/shm\/)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, TargetProcessId], limit=1000)

Every query has an explicit disposition. Alert packages are complete operational designs but remain blocked from production by missing tenant parse, positive canary, and measured benign-baseline evidence.

A02 · Kestra-Orchestrator-Origin-Execution DESIGN ONLY

• Cadence: 15m with 20m lookback and 5m overlap.
• Grouping and suppression: aid, ComputerName; 60 minutes for the same aid and TargetProcessId; do not suppress a new process ID or materially different CommandLine
• Owner / SLA: Detection Engineering; SOC triage within 15 minutes during coverage hours.
• Positive test: In an isolated canary Kestra worker, run an approved benign flow that launches /bin/sh with a unique marker and no network action.
• Benign baseline: Run Q02 across at least seven representative days, label approved script tasks, and derive exact namespace/image/command exclusions outside the generic pack.
• Rollback: Disable the scheduled search in Falcon Search > Scheduled searches, preserve the last execution details, and revert to analyst-run Q02

A04 · Linux-Download-Piped-To-Shell DESIGN ONLY

• Cadence: 15m with 20m lookback and 5m overlap.
• Grouping and suppression: aid, ComputerName; 60 minutes for identical aid, TargetProcessId, and CommandLine; never suppress a new host
• Owner / SLA: Detection Engineering; SOC triage within 15 minutes during coverage hours.
• Positive test: Serve a harmless echo-only script from a local isolated test service and pipe it to sh inside a canary container; do not contact external infrastructure.
• Benign baseline: Measure at least seven representative days, inventory configuration-management and bootstrap URLs, and test exact allowlist exclusions against the canary.
• Rollback: Disable the scheduled search in Falcon Search > Scheduled searches, preserve the last execution details, and revert to analyst-run Q04

A05 · Linux-XMRig-RandomX-Mining-Behavior DESIGN ONLY

• Cadence: 15m with 30m lookback and 15m overlap.
• Grouping and suppression: aid, ComputerName; 24 hours only for documented authorized test systems and the same process ID; do not suppress new hosts
• Owner / SLA: Detection Engineering; SOC triage within 15 minutes during coverage hours.
• Positive test: Create a non-executing canary command line containing unique xmrig and RandomX markers, plus a separate harmless echo of the modprobe-msr-allow_writes string; do not load modules or mine.
• Benign baseline: Review at least 30 representative days for authorized mining, HPC, or MSR tuning systems and document owners and exclusions.
• Rollback: Disable the scheduled search in Falcon Search > Scheduled searches, preserve the last execution details, and revert to analyst-run Q05

Custom IOA candidates

These are detect-only pilots. Nothing here authorizes prevent mode.

Copy blocks preserve source tags and a 30-day revalidation date. Treat network values as detect/enrich pivots, not automatic prevention.

type,value,action,severity,expiration,description,tags
ipv4,172.232.38.92,detect,high,2026-09-29,Kestra reverse-shell endpoint TCP 32991,source:S02 campaign:kestra
domain,auto.c3pool.org,detect,high,2026-09-29,Monero mining pool used in observed Kestra activity,source:S02 campaign:kestra
ipv6,2001:41d0:701:1100::adfd,enrich,medium,2026-09-29,c3pool endpoint associated with Kestra activity,source:S02 campaign:kestra
ipv4,47.86.197.116,enrich,medium,2026-09-29,c3pool endpoint associated with Kestra activity,source:S02 campaign:kestra

172.232.38.92
auto.c3pool.org
2001:41d0:701:1100::adfd
47.86.197.116

/api/v1/{tenant}/flows/{namespace}/configs
/api/v1/{tenant}/executions/{namespace}/configs

No Kestra-specific malicious file hash was published by the accessible primary compromise source as of 2026-08-30. Local artifacts such as the Docker socket path and collection-script name are carried in section 4 as behavioral context.

Controls are ordered by time-to-risk-reduction. Advisory items require deployment-specific design; deployable designs still require pilot and change approval.

Deployable-design playbooks

CTRL01 playbook · Upgrade every vulnerable Kestra deployment

1. Capture current version, pinned image digest, configuration, database backup, health checks, and representative flow results.
2. Review vendor release notes from the current version to the target and confirm rollback support.
3. Upgrade one non-production or low-risk cohort to a fixed supported release.
4. Verify running version, authentication regression behavior in a lab, queue health, workers, and representative flows.
5. Expand only after the pilot meets service thresholds and no migration rollback blocker exists.
6. On failure, stop expansion and execute the documented backup/image rollback path.
7. Retain version/digest evidence, health results, approvals, and the named platform owner.

CTRL04 playbook · Remove or isolate Docker daemon control from Kestra workers

1. Export current Compose/Helm/task-runner configuration and list workflows that require Docker execution.
2. Capture worker mounts and confirm whether /var/run/docker.sock is present.
3. Remove the socket from one pilot pool or redirect that pool to an authenticated isolated engine.
4. Run the representative task suite and verify the worker cannot enumerate unrelated containers.
5. Expand only when task success, output collection, and runtime isolation meet owner criteria.
6. Rollback the pilot manifest/endpoint if stop conditions occur, then re-run worker and task health checks.
7. Retain manifest diff, engine identity, access-denied proof, task results, and approvals.

CTRL08 playbook · Capture and protect request-level Kestra access logs

1. Capture current logging configuration, application latency, collector health, and retention settings.
2. Enable the documented access logger on one non-production server with a privacy-reviewed format.
3. Send harmless authenticated and rejected requests and validate parsed fields and timestamps.
4. Monitor volume, latency, secret leakage, and collector backpressure for 24 hours.
5. Expand only after parser ownership, retention, and alerting for collector failure are approved.
6. Rollback the logger configuration on performance or privacy stop conditions and verify application health.
7. Retain redacted sample events, parser version, configuration diff, health metrics, and owner approval.

Activation: Confirmed Q02/Q04/Q05 behavior on a Kestra host without an approved workflow explanation; Any connection to I01 from Kestra or shell ancestry; Evidence of Docker-socket environment discovery, XMRig, or unauthorized flow creation/execution; Microsoft-reported Kestra pattern corroborated by two or more independent telemetry types

Decision authority: Incident Commander with Kestra Platform and Business Service Owner input; emergency endpoint isolation may follow the standing incident policy.

Preservation order

• Alert and query results with exact time window and query version
• Raw Falcon process/network/DNS events
• Full process tree and volatile process/network state
• Suspicious files, paths, hashes, permissions, and container metadata
• Kestra flow definitions, execution records, logs, KV/audit/access logs, and configuration
• Docker/container runtime inventory and mount/socket evidence
• Identity, tokens, credential identifiers, cloud/provider audit records
• Responder actions and tool output with integrity/provenance metadata

Continuity exceptions

• Do not isolate a critical orchestrator until clean capacity or an approved continuity path exists unless active harm outweighs outage risk.
• Do not rotate credentials before preserving identifiers, scopes, use history, and dependency mapping.
• Do not destroy compromised containers or logs before evidence capture; snapshot where policy and platform support it.
• Do not contact the listed attacker or mining infrastructure for testing.

Recovery and closure

Prerequisites: All Kestra instances are on fixed supported versions; Malicious flows, scripts, miners, and unauthorized KV data are removed or systems rebuilt cleanly; Docker socket and privilege exposure are corrected or explicitly risk-accepted; Potentially exposed credentials are rotated/revoked with dependent services healthy; Q02-Q07 re-hunts and access-log review are complete for the scoped window; Falcon sensor, logging, time synchronization, and collector health are confirmed

Closure gates: Incident Commander accepts documented root-cause confidence and remaining gaps; No new correlated hits during at least 72 hours of heightened monitoring; Seven-day retrospective re-hunt completed across affected and peer systems; Service owner confirms workflow integrity and normal operations; All temporary exceptions have owners and expiry dates; Post-incident review assigns durable control and detection actions

Re-hunt: Run Q02-Q07 immediately after containment, again after credential rotation and clean rebuild, at 72 hours, and at seven days; rerun H08 after access-log ingestion becomes available.

Coverage is scored by evidence state, not by the existence of a query. No row is rated Good because no canary or production evidence exists.

Validation evidence

This block is ready to paste into an ITSM record; leave Findings blank until the hunt records tenant evidence.

TITLE:        CVE-2026-49869 Kestra authentication-bypass RCE hunt — v0.1
SEVERITY:     critical — unauthenticated network access can create and execute root-context worker tasks
SCOPE:        Kestra OSS; Linux process plus IPv4/IPv6 network and DNS telemetry; Kestra access logs when available
HYPOTHESIS:   H02 Kestra/Java worker lineage launches shell or execution utilities
              H03 Docker socket and container environment discovery follows execution
              H04 curl or wget content is piped directly into a Unix shell
              H05 XMRig or RandomX mining behavior monetizes access
              H06 reported reverse-shell or mining infrastructure is contacted
              H07 temporary artifacts receive restrictive or immutable permissions
              H08 unauthenticated /configs flow creation and execution appears in application access logs
QUERIES RUN:  Q01 inventory; Q03/Q06/Q07 hunt; Q02/Q04/Q05 alert-candidate
DO FIRST:     run Q02 over 14d, then correlate same-host results through Q03–Q07
FINDINGS:
GAPS:         H08 parser/repository unknown; ancestry and field semantics not tenant-confirmed; no Kestra-specific payload hash
ACTIONS:      Kestra Platform Owner inventories and patches; Detection Engineering parse-tests Q02 and records canary/baseline evidence
OWNER:        Detection Engineering with Kestra Platform Owner
VERSION:      v0.1 Draft — 2026-08-30 — STATIC REVIEW PASSED

This version records no Falcon tenant execution, canary, deployment, or measured production evidence.

All references are HTTPS sources captured as current-run UTF-8 snapshots with SHA-256 hashes in the adjacent source manifest. Access dates are UTC.

Local static checks do not prove Falcon parsing, tenant field availability, result meaning, positive detection, benign behavior, or prevention.