Suffix Matching Is Not Authorization: Lessons from CVE-2026-49869 in Kestra

· Dev.to