CVE-2026-73247 Overview
CVE-2026-73247 is a Server-Side Request Forgery (SSRF) vulnerability in Kestra, an open-source event-driven orchestration platform. Versions prior to 2.0.0 fail to restrict the destination of HTTP requests issued by the http() Pebble template function. The function in core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes user-controlled URI arguments directly to URI.create() and the server-side HTTP client without validating the target address. An unauthenticated attacker can import and execute a flow that reaches private, loopback, or link-local addresses, including cloud instance metadata endpoints.
Critical Impact
Unauthenticated attackers can exfiltrate cloud metadata credentials and pivot to internal services reachable from the Kestra server.
Affected Products
- Kestra orchestration platform, all versions prior to 2.0.0
- Self-hosted Kestra deployments in cloud environments (AWS, Azure, GCP)
- Kestra instances exposing the flow import or execution API
Discovery Timeline
- 2026-08-11 - CVE-2026-73247 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-73247
Vulnerability Analysis
The flaw resides in Kestra's Pebble template engine integration, specifically the HttpFunction class that implements the http() function available within flows. When a flow invokes http(uri=...), the supplied URI string is handed to URI.create() and then dispatched by the server-side HTTP client. No filtering exists for private RFC 1918 ranges, IPv4/IPv6 loopback addresses, or link-local ranges such as 169.254.0.0/16.
Because an attacker can import and execute a flow without authentication on vulnerable deployments, the SSRF is remotely reachable across the network. The classification maps to CWE-918: Server-Side Request Forgery. The scope change reflected in the CVSS vector indicates the exploited component (Kestra) is used to affect resources beyond its own security boundary, such as cloud metadata services or internal admin APIs.
Root Cause
The root cause is missing egress destination validation in HttpFunction.java. The code trusts the user-provided URI and neither performs DNS resolution checks nor enforces an allow-list of permitted hosts before issuing the outbound request. Redirect handling is likewise unconstrained, permitting DNS rebinding or 30x-based bypass techniques.
Attack Vector
An attacker submits a Kestra flow definition that calls http() with a URI pointing at an internal target. Typical targets include http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS, http://metadata.google.internal/ on GCP, or http://127.0.0.1:<port>/ for co-located services. The Kestra worker executes the request under its own network identity and returns the response body into the flow context, where it can be logged, exported, or forwarded to an attacker-controlled endpoint.
Refer to the Kestra GitHub Security Advisory GHSA-r56g-q4p6-m3p6 for the vendor's technical description.
Detection Methods for CVE-2026-73247
Indicators of Compromise
- Outbound HTTP requests from Kestra worker processes to 169.254.169.254, metadata.google.internal, or metadata.azure.com.
- Flow definitions containing http() calls that reference private RFC 1918 ranges, 127.0.0.0/8, or ::1.
- Unexpected flow imports through the Kestra API from unauthenticated or unknown sources.
- Anomalous access to internal admin dashboards or databases from the Kestra server's IP address.
Detection Strategies
- Inspect application logs for HttpFunction invocations resolving to non-routable or metadata addresses.
- Correlate Kestra process network telemetry against an allow-list of expected external destinations.
- Audit stored flows and flow templates for use of the http() function with attacker-controlled inputs.
Monitoring Recommendations
- Alert on any egress from Kestra hosts to cloud metadata IPs; these should never be legitimate targets from worker pods.
- Monitor Kestra API endpoints responsible for flow creation and execution for unauthenticated access attempts.
- Capture and retain full URI arguments passed to http() for forensic review.
How to Mitigate CVE-2026-73247
Immediate Actions Required
- Upgrade Kestra to version 2.0.0 or later, which restricts http() destinations.
- Require authentication on all Kestra API endpoints, particularly flow import and execution routes.
- Block Kestra worker egress to cloud metadata services at the network or host firewall.
- Enforce IMDSv2 on AWS and equivalent metadata protections on Azure and GCP.
Patch Information
The vendor addressed the issue in Kestra 2.0.0. See the Kestra GitHub Security Advisory GHSA-r56g-q4p6-m3p6 for release details and patch commits.
Workarounds
- Restrict outbound network access from Kestra workers to a defined allow-list of external hosts.
- Place Kestra behind an egress proxy that rejects requests to private, loopback, and link-local ranges.
- Disable or restrict flow imports from untrusted sources until upgrade is complete.
# Example iptables rules blocking metadata and private ranges from Kestra host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
