Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-49869, describes an unauthenticated remote code execution flaw in Kestra due to an authentication bypass in the AuthenticationFilter. The core issue was that the AuthenticationFilter used request.getPath().endsWith("/configs") to whitelist a public configuration endpoint. This suffix match was too broad, allowing any API path ending in /configs to bypass authentication. An attacker could exploit this to create and execute arbitrary workflows, leading to RCE.
By analyzing the GitHub advisory (GHSA-5vc5-wxxq-3fjx) and the commit 2475839f6859bd4ae7952bff2c252668320cfda5 (which explicitly states 'fix(auth): potential authentication bypass in the authentication filter'), the changes in webserver/src/main/java/io/kestra/webserver/filter/AuthenticationFilter.java were identified. Specifically, the doFilter method was modified. The vulnerable endsWith("/configs") check was replaced with a precise "/api/v1/configs".equals(normalizedPath) check, along with the introduction of a normalizePath helper function to handle path variations. This change directly addresses the authentication bypass by ensuring only the intended exact path is whitelisted.
The secondary impact of SSRF via HttpFunction.java is a consequence of the authentication bypass, as the HttpFunction itself lacks URI filtering. However, the primary vulnerability enabling unauthenticated exploitation is the flaw in AuthenticationFilter.doFilter.
