CVE-2026-73247: Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io/kestra/core/runners/pebble/functions/HttpFunction.javato a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73247?
CVE-2026-73247 has a high severity score of 8.6.
What kind of vulnerability is CVE-2026-73247?
CVE-2026-73247 is a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-73247?
To fix CVE-2026-73247, upgrade Kestra to version 2.0.0 or later.
What services are affected by CVE-2026-73247?
CVE-2026-73247 allows unauthenticated access to internal services and cloud metadata.
What does CVE-2026-73247 mean for Kestra users?
CVE-2026-73247 exposes Kestra users to risks associated with unauthorized access to sensitive internal resources.