CVE-2026-73247 in Kestra
Summary
by MITRE • 08/12/2026
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within Kestra's HttpFunction implementation in versions prior to 2.0.0, specifically in the core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java file. This flaw represents a critical security oversight that enables unauthorized remote code execution through server-side request forgery attacks. The vulnerability stems from insufficient input validation and access control mechanisms that fail to properly sanitize user-provided URI arguments passed to HTTP requests.
The technical implementation flaw occurs when the HttpFunction processes user-controllable http() uri arguments by directly passing them to URI.create() and subsequently to server-side HTTP client implementations without proper destination restrictions. This design allows attackers to construct malicious URIs that target internal network services, loopback addresses, or link-local destinations that should normally be restricted. The lack of validation creates a path for attackers to bypass normal network security controls and access sensitive internal resources.
This vulnerability has severe operational impact as it enables unauthenticated remote attackers to execute arbitrary HTTP requests against internal systems without proper authentication or authorization. Attackers can leverage this weakness to access internal services, retrieve cloud metadata, perform reconnaissance on internal networks, and potentially escalate privileges through information disclosure or service exploitation. The attack surface extends to any internal resource accessible from the Kestra server, including databases, internal APIs, or configuration management systems.
The vulnerability aligns with CWE-918 (Server-Side Request Forgery) and maps to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) and T1566 (Phishing). Organizations using Kestra versions prior to 2.0.0 face significant risk exposure, particularly in environments where internal network segmentation is not properly enforced. The attack requires minimal privileges as no authentication is needed, making it particularly dangerous in multi-tenant or shared hosting environments.
Recommended mitigations include upgrading to Kestra version 2.0.0 or later where proper URI validation and access restriction mechanisms have been implemented. Administrators should also implement network-level restrictions to prevent outbound connections to internal addresses from the Kestra server, deploy firewall rules to block access to loopback and private IP ranges, and consider implementing additional input validation at the application level. Organizations should conduct thorough security assessments of their orchestration workflows to identify and remediate similar vulnerabilities in other components that may process user-controllable HTTP requests.