If It Ends the Same, Let It Through" — The Comparison Operator That Broke Kestra (CVE-2026-49869)

On September 2, 2026, CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities (KEV) catalog. That's not a theoretical risk — it means exploitation has been confirmed in the wild — and federal agencies were given until September 5 to remediate. The CVSS score is a perfect 10.0. And if you trace the entire incident back to its source, it comes down to a single string-comparison method call in Java. request.getPath().endsWith("/configs") That's the whole bug. "Does the path end in /configs?" and "is this path exactly the config endpoint?" sound similar, but they're entirely different questions — and Kestra's authentication filter mixed the two up. At a glance Target: Kestra OSS (open-source, event-driven workflow orchestration platform) Affected versions: below 1.0.45, and 1.1.0 up to (not including) 1.3.21 Fixed in: 1.0.45, 1.3.21 CVSS 3.1: 10.0 (Critical) Authentication: none required — everything shown in this post works with zero credentia