{"schema":"vulnpedia.research/1","cve":"CVE-2026-49869","references":[{"url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-06-26T20:58:19.576Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-06-26T20:58:19.576Z","url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-03T03:55:27.114Z","url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"},{"source":"nvd","sourceId":"CVE-2026-49869","modified":"2026-10-25T17:10:00.197","url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-03T03:55:27.114Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-09-03T03:55:27.114Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869"},{"source":"nvd","sourceId":"CVE-2026-49869","modified":"2026-10-25T17:10:00.197","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869"}]},{"source":"euvd","sourceId":"EUVD-2026-39922","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39922","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-39922","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39922"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/"}]},{"url":"https://previdian.com/CVE-2026-49869","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://previdian.com/CVE-2026-49869"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-09","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-09"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-10","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-10"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-11","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-11"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-12","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-12"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-13","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-13"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-14","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-14"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-16","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-16"}]},{"url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-18","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-18"}]},{"url":"https://vulncheck.com/xdb/696a69a07712","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"696a69a07712","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"696a69a07712","modified":"2026-08-26T00:00:00Z","url":"https://vulncheck.com/xdb/696a69a07712"}]},{"url":"https://github.com/Ap0dexMe0/CVE-2026-49869","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"696a69a07712","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"696a69a07712","modified":"2026-08-26T00:00:00Z","url":"https://github.com/Ap0dexMe0/CVE-2026-49869"}]},{"url":"https://vulncheck.com/xdb/55f8cc2bb03e","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"55f8cc2bb03e","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"55f8cc2bb03e","modified":"2026-08-26T00:00:00Z","url":"https://vulncheck.com/xdb/55f8cc2bb03e"}]},{"url":"https://github.com/EQSTLab/CVE-2026-49869","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"55f8cc2bb03e","modified":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"55f8cc2bb03e","modified":"2026-08-26T00:00:00Z","url":"https://github.com/EQSTLab/CVE-2026-49869"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/Ap0dexMe0/CVE-2026-49869","source":"poc-in-github","sourceId":"CVE-2026-49869","description":"Kestra Auth-Bypass Vulnerability Checker","modified":"2026-09-10T09:09:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-49869","url":"https://github.com/Ap0dexMe0/CVE-2026-49869"},{"source":"poc-in-github","sourceId":"CVE-2026-49869","modified":"2026-09-10T09:09:06Z","url":"https://github.com/Ap0dexMe0/CVE-2026-49869"}],"tags":[]},{"url":"https://github.com/EQSTLab/CVE-2026-49869","source":"poc-in-github","sourceId":"CVE-2026-49869","description":"Kestra Unauthenticated RCE","modified":"2026-10-05T01:59:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-49869","url":"https://github.com/EQSTLab/CVE-2026-49869"},{"source":"poc-in-github","sourceId":"CVE-2026-49869","modified":"2026-10-05T01:59:55Z","url":"https://github.com/EQSTLab/CVE-2026-49869"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"696a69a07712","url":"https://vulncheck.com/xdb/696a69a07712","cve":"CVE-2026-49869","dateAdded":"2026-06-30T20:00:23Z","modified":"2026-08-26T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/Ap0dexMe0/CVE-2026-49869","observations":[{"dateAdded":"2026-06-30T20:00:23Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"696a69a07712","modified":"2026-08-26T00:00:00Z","url":"https://vulncheck.com/xdb/696a69a07712"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"55f8cc2bb03e","url":"https://vulncheck.com/xdb/55f8cc2bb03e","cve":"CVE-2026-49869","dateAdded":"2026-09-29T08:11:24Z","modified":"2026-08-26T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/EQSTLab/CVE-2026-49869","observations":[{"dateAdded":"2026-09-29T08:11:24Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"55f8cc2bb03e","modified":"2026-08-26T00:00:00Z","url":"https://vulncheck.com/xdb/55f8cc2bb03e"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-08-26T00:00:00Z","modified":"2026-08-26T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":true,"vendorProject":"Kestra","product":"Kestra OSS","dueDate":"2026-09-05T00:00:00Z","cisaDateAdded":"2026-09-02T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","modified":"2026-08-26T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/","dateAdded":"2026-08-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-49869","dateAdded":"2026-09-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://previdian.com/CVE-2026-49869"},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-09","dateAdded":"2026-10-09T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-09"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-10","dateAdded":"2026-10-10T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-10"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-11","dateAdded":"2026-10-11T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-11"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-12","dateAdded":"2026-10-12T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-12"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-13","dateAdded":"2026-10-13T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-13"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-14","dateAdded":"2026-10-14T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-14"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-16","dateAdded":"2026-10-16T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-16"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","catalog":"VulnCheck KEV","kind":"report","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-18","dateAdded":"2026-10-18T00:00:00Z","firstPartyCanary":true,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-49869","url":"https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2026-49869&date=2026-10-18"}]}]}