CVE-2026-73247

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

HIGH 8.6EPSS 0.4%

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Affected: kestra-io · kestra
CVSS v3.1 GITHUB: 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.41% chance of exploitation in the next 30 days, 33rd percentile
Published: 2026-08-11
Updated: 2026-08-13

Proof-of-concept exploits (1)

advisories/GHSA-r56g-q4p6-m3p6

References

CVE Record
NVD entry