Critical Kestra Auth Bypass CVE-2026-49869 Leaves Hundreds of Instances Exposed Online

·1 views

A critical authentication bypass vulnerability, CVE-2026-49869, was discovered in Kestra OSS, affecting versions up to 1.3.20 and receiving a maximum CVSS score of 10.0. The flaw resided in the AuthenticationFilter, where any API request path ending in '/configs' bypassed Basic Authentication, allowing unauthenticated attackers to reach protected endpoints. Because Kestra ships with script execution plugins by default, an anonymous attacker could create and trigger workflows to execute arbitrary commands on the server. ZoomEye scans conducted on September 16, 2026 identified between 119 and 231 publicly exposed Kestra instances, though the figures overlap and do not confirm which versions are running. Kestra has released patched versions 1.0.45 and 1.3.21, and the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on September 2, 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tool Turns GitHub Activity into Roast-Worthy RPG Character Cards

A developer built a weekend side project that converts any public GitHub profile into a role-playing game character, complete with a class, level, and letter grades across skills like Backend, DevOps, and Machine Learning. The grades are derived from real account data, including repositories, programming languages, topics, stars, and account age, making the results surprisingly accurate. As a demonstration, Linus Torvalds was rendered as a Mythic Level 99 'Linux Kernel Architect' with a failing Frontend grade and a jab about never centering a div. The tool requires no login, runs on Next.js with Vercel, and uses Claude AI for structured output alongside the GitHub REST API and Upstash Redis for caching. Each skill card includes a 'Prove us wrong' button, with the creator hoping the roasts motivate users to actually improve their weakest areas.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Stateful vs. Stateless Frontend Design Explained Through a Food Delivery App

A technical explainer on DEV Community uses a Snappfood-like food delivery app as a model to illustrate the difference between stateful and stateless frontend architecture. Stateless systems process each input independently without retaining memory of prior interactions, while stateful systems depend on accumulated history to determine current behavior. The article clarifies that a stateless API does not imply a stateless business domain, since data like baskets and orders is stored durably in databases rather than in server memory. As frontend applications grow beyond a few pages, decisions about who owns each piece of state, how long it persists, and what serves as the source of truth become critical architectural choices. The piece is intended as an educational model and does not reflect Snappfood's actual internal implementation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Password Strength Estimator Tool Shows How Character Choices Affect Crack Time

A browser-based password strength calculator has been developed to help users understand how password length and character variety affect resistance to brute-force attacks. The tool analyzes factors such as character pool size, estimated entropy, and hypothetical attacker hardware scenarios to illustrate how small password changes can dramatically alter theoretical crack times. Designed purely for education, it advises users to test fictional passwords rather than real ones to protect their privacy. The tool acknowledges its limitations, noting it cannot account for real-world factors like breached credential databases, weak hashing algorithms, or pattern-based guessing. Its guidance aligns with recommendations from security bodies like NIST and OWASP, which emphasize rate limiting, salted adaptive hashing, and multi-factor authentication over simple password composition rules.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mislabeled debug pod silently routed live checkout traffic to staging DB for 19 days

A production incident at a software team went undetected for 19 days after an engineer copied a checkout deployment manifest into the production namespace to reproduce a bug, inadvertently retaining the same pod labels used by the production Kubernetes Service selector. Because Kubernetes Services route traffic based solely on label queries, the three debug pods matched the selector alongside six production pods and received roughly one-third of real customer checkout writes — all directed at the staging database. No alerts fired because the debug pods returned HTTP 200 responses, reported metrics under the same service label, and even showed marginally better latency, masking the misdirection entirely. The issue was discovered only when a colleague noticed a real customer order, complete with a live card reference, inside the staging admin tool. In response, the team introduced unique per-deployment instance labels, a policy rule blocking config-to-namespace environment mismatches, and a nightly audit report flagging Services backed by more than one workload.

0 comments Read more at DEV Community