Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73247Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

High 8.6

In plain English

A high-severity server-side request forgery in kestra from kestra-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.kestra:core	no fix listed	GHSA-r56g-q4p6-m3p6
Maven	io.kestra:kestra-core	2.0.0	GHSA-r56g-q4p6-m3p6

Affected products (as reported)

Vendor	Product	Versions
kestra-io	kestra	< 2.0.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-r56g-q4p6-m3p6 x_refsource_CONFIRM