Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-73247: Kestra can access internal or cloud metadata services

CVE-2026-73247 · published 2 months ago

Summary

Versions of Kestra before 2.0.0 let a user‑controlled function call any web address, including internal network endpoints or cloud metadata URLs. An attacker could run a flow that contacts these hidden services without authenticating, potentially exposing sensitive information. Update Kesura to version 2.0.0 or later, or apply configuration to block private and loopback addresses.

What to do

Update io.kestra:kestra-core to version 2.0.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	kestra-io	kestra	< 2.0.0
maven	–	io.kestra:core	<= 1.3.31
maven	–	io.kestra:kestra-core	< 2.0.0 Fix: upgrade to 2.0.0

Original advisory text

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73247... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73247 Vendor Advisory
https://github.com/kestra-io/kestra/security/advisories/GHSA-r56g-q4p6-m3p6 Vendor Advisory
https://github.com/advisories/GHSA-r56g-q4p6-m3p6

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published11 Aug 2026

Updated4 Nov 2026

First seen11 Aug 2026

Sources

CVE-2026-73247 · NVD

CVE-2026-73247 · MITRE

CVE-2026-73247 · OSV

GHSA-r56g-q4p6-m3p6 · GHSA

Track software like this

Free during beta