Tag archive
Why a Kestra authentication filter bypass patched in June 2026 became an urgent remediation item after CISA added it to the KEV catalog in September.
A technical explanation of the Kestra authentication bypass CVE-2026-49869 and the general authorization design lesson it exposes.
ZoomEye exposure data for Kestra workflow orchestrators after CVE-2026-49869, with an honest reading of what the counts mean.
ZoomEye exposure data for Kestra workflow orchestrators after CVE-2026-49869, with an honest reading of what the counts mean.
Why a path-suffix authentication check in Kestra OSS turned into unauthenticated remote code execution, and what operators should do.
In February 2022 I published my first post here, called Kestra, infinitely scalable open source...
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
ZoomEye measurement of AI gateway and orchestration platform exposure, with credential-risk interpretation.
Every developer has seen it: an AI prototype that impresses in demos but breaks the moment real users...
I Built an AI-Powered Daily LeetCode Planner Using Workflow Automation Recently, I...
When disasters strike, response time becomes critical. Floods, earthquakes, cyclones, wildfires, and...
Introduction Before starting the Kestra Fundamentals course, I used to think workflow...