A flow naming exploit allowed an attacker to name flows in a way that creates paths ending in /configs, bypassing authentication across multiple API actions such as creating, running, deleting flows, dashboards, and logs.

The flaw was disclosed through Kestra's GitHub bug bounty and was added to the CISA KEV catalog, with exploitation observed in the wild in crypto-miner deployments.

Remediation guidance advises upgrading to patched versions (1.0.45 for the 1.0.x branch and 1.3.21 for 1.1.x through 1.3.x), restarting worker containers, and, if patching cannot be immediate, applying mitigations like a proxied exact-path rule, rotating secrets, and reviewing history.

The vulnerability also exposed a secondary surface via SSRF through the Pebble template engine’s http() function, which could reach cloud metadata endpoints and leak credentials.

Kestra OSS had an authentication bypass due to a flawed endsWith("/configs") check in the AuthenticationFilter, causing setup/config endpoints to be treated as public and skip authentication.

Because Kestra ships with default script-execution plugins (shell, Python, Node, etc.) that run as root inside the worker container when a flow executes, the flaw enabled unauthenticated remote code execution.

The patch switches from a suffix-based check to exact path matching, limiting authentication bypass to only the precise public endpoints (/api/v1/configs, /api/v1/{tenant}/configs).

A step-by-step reproduction showed how an attacker can create a flow named configs, trigger execution, and retrieve command output from logs without authentication.