CVE-2026-73247
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Kestra before version 2.0.0 passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.
Risk Assessment
An unauthenticated attacker could exploit this to access internal network resources or cloud metadata, potentially leading to sensitive data exposure or privilege escalation.
Recommendation
Update Kestra to version 2.0.0 or later. Restrict access to the http() function for unauthenticated users.
Original NVD description (English source)
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.