OS Command Injection in Kestra OSS (CVE‑2026‑49869) Enables Unauthenticated Workflow Execution
What It Is — Kestra OSS, an open‑source workflow orchestration engine, contains an OS command‑injection flaw (CVE‑2026‑49869). An attacker can craft a malicious workflow definition that the engine executes as a system command.
Exploitability — The vulnerability is remotely exploitable without authentication; proof‑of‑concept code is publicly available. CVSS rating is reported as 9.1 (High).
Affected Products — Kestra OSS (all versions prior to the vendor’s security release).
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in the execution‑control objective: without proper safeguards, any user (or attacker) can run arbitrary OS commands.
- Continuous control‑mapping lets you tie this gap to a single VCF control objective, which in turn satisfies multiple frameworks (e.g., NIST CSF 2.0).
- Capturing runtime logs and evidence of workflow validation provides a defensible audit trail that buyers increasingly demand.
Recommended Actions
- Apply the vendor‑released patch or upgrade to the latest Kestra OSS version.
- Enforce strict validation of workflow definitions and restrict who can submit them.
- Deploy runtime monitoring and immutable logging of workflow execution to capture evidence of control enforcement.
- Map the “execution‑control” objective to your framework of record to demonstrate remediation.
Source: CISA KEV – CVE‑2026‑49869