Kestra's Path Suffix Bug: When a Framework Forgets to Check the Whole Route

Why a Kestra authentication filter bypass patched in June 2026 became an urgent remediation item after CISA added it to the KEV catalog in September.