erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: June 3, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 6 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Kestra CVE-2026-49869: Exploited Unauthenticated RCE. Teams self-hosting Kestra OSS 1.0.x before 1.0.45 or 1.1.0 through 1.3.20, especially where the API port is reachable from the internet or shared networks or the worker has the Docker socket mounted.
  • Do you run any of these? Mirasvit Mirasvit Full Page Cache Warmer. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-06.
  • PyPI: 5 critical advisories (mlflow, jupyter_enterprise_gateway, mistral). Check with pip-audit (or: pip show <package>).
  • Maven: 1 critical advisory (org.apache.mina:mina-core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-49869

Kestra CVE-2026-49869: Exploited Unauthenticated RCE

If you run Kestra OSS below 1.0.45 or 1.3.21 and anyone untrusted can reach its API, assume it is compromised: upgrade, then rotate every secret the workers could see.

Must act: Teams self-hosting Kestra OSS 1.0.x before 1.0.45 or 1.1.0 through 1.3.20, especially where the API port is reachable from the internet or shared networks or the worker has the Docker socket mounted.

Can relax: Teams that do not run Kestra, and Kestra users already on 1.0.45, 1.3.21 or any later release who have checked for signs of earlier compromise.

  1. Find every Kestra instance and its image tag or version.
  2. Upgrade to 1.0.45 or 1.3.21 or later; 1.1.x and 1.2.x users must move to 1.3.21+.
  3. Take the Kestra API and UI off the internet and put them behind a VPN or authenticating proxy.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-45247Mirasvit Mirasvit Full Page Cache Warmer
Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability		2026-06-06

Critical advisories by ecosystem 6

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 5

Check: pip-audit (or: pip show <package>)

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>