CISA says attackers are exploiting a Kestra authentication bypass that lets unauthenticated requests create workflows and execute commands as root inside the worker container.