Unauthenticated SSRF in Kestra OSS via Pebble http() Function

Kestra OSS versions up to 1.3.31 and versions prior to 2.0.0 contain a critical Server-Side Request Forgery (SSRF) vulnerability due to insufficient validation in the Pebble template engine's http() function. The vulnerability resides in core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java, where user-supplied URLs are processed by URI.create() without any sanitization or restriction on target destinations. An unauthenticated attacker can exploit this by uploading a malicious Flow YAML via the Kestra API. The lack of tenant authentication, combined with the ability to define arbitrary target schemes (including file:// or gopher://) and target ranges (including localhost or cloud metadata services like 169.254.169.254), allows the attacker to exfiltrate cloud credentials, query internal infrastructure, or interact with restricted localhost services. This represents a significant risk for deployments running in cloud environments.

Attack Chain

1. Attacker identifies a Kestra OSS instance reachable via the network.
2. Attacker crafts a malicious YAML flow configuration containing the http() function targeting an internal or metadata endpoint.
3. Attacker uses a POST request to /api/v1/main/flows/import to upload the malicious flow definition without requiring authentication.
4. Attacker uses a POST request to the /api/v1/main/executions/ endpoint to trigger the flow execution.
5. The Kestra runner evaluates the Pebble template, invoking the HttpFunction.java logic with the attacker-controlled URI.
6. The backend performs an outbound HTTP request from the server to the target internal/metadata service.
7. Attacker retrieves the response data through the flow execution output or logs to exfiltrate sensitive metadata or service responses.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass network boundaries. Attackers can exfiltrate sensitive information from cloud provider metadata endpoints (e.g., AWS/GCP/Azure instance metadata service), interact with internal services that are otherwise protected by firewalls, and potentially escalate privileges by harvesting cloud-assigned IAM roles or service credentials.

Recommendation

Prioritize the immediate mitigation of CVE-2026-73247. Update Kestra OSS to a patched version (>= 1.3.32 or >= 2.0.0). Until updates are deployed, implement strictly scoped network egress controls for the Kestra server to prevent connections to internal RFC1918 subnets and the cloud provider metadata service (169.254.169.254). Monitor web server access logs for POST requests to /api/v1/main/flows/import from untrusted or unexpected source IPs.