CVE-2026-73247: Kestra-Io Kestra

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Affected products

• Kestra-Io Kestra: before 2.0.0 (fixed in 2.0.0)

Published 2026-08-11. Last modified 2026-09-09.