Suffix Matching Is Not Authorization: Lessons from CVE-2026-49869 in Kestra A single string comparison decided whether an HTTP request to a workflow orchestration platform needed credentials. The comparison was endsWith("/configs") . Because the platform allowed caller-controlled resource identifiers in the same URL position, any path that happened to end with those characters skipped authentication. The result, tracked as CVE-2026-49869, was rated CVSS 10.0 and added to CISA's Known Exploi...