{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:35.068Z","products":["kestra"],"actNowTotal":1,"results":[{"query":"kestra","matched":1,"actNow":1,"events":[{"id":"kev-2026-09-02-kestra-kestra-oss","url":"https://securitythreatpulse.com/events/kev-2026-09-02-kestra-kestra-oss","title":"Kestra OSS: attackers can run commands on it","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 128 days old, so current versions are being attacked. The severity score is critical (10.0).","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-49869"],"vendor":"Kestra","product":"Kestra OSS","affectedProducts":[{"vendorKey":"kestra","productKey":"kestraoss","vendor":"Kestra","product":"Kestra OSS","slug":"kestra/kestraoss","kind":"direct","evidence":["kev"]}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.","cvss":10,"epss":0.02095,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-02","kevDueDate":"2026-09-05","firstSeenAt":"2026-09-02T00:00:00.000Z","updatedAt":"2026-11-01T21:07:40.565Z","newestEvidenceAt":"2026-09-02T00:00:00.000Z"}]}]}