CVE-2026-73247: Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

September 17, 2026

The Pebble template engine’s http() function in Kestra OSS accepts user-controlled URLs without any validation, allowing Server-Side Request Forgery (SSRF) attacks. An unauthenticated attacker can import a malicious Flow YAML and execute it to access internal services, cloud metadata endpoints (AWS 169.254.169.254), or localhost services. The vulnerability affects all Kestra OSS deployments with default configuration.

References

github.com/advisories/GHSA-r56g-q4p6-m3p6
github.com/kestra-io/kestra/security/advisories/GHSA-r56g-q4p6-m3p6
nvd.nist.gov/vuln/detail/CVE-2026-73247

Code Behaviors & Features

Detect and mitigate CVE-2026-73247 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →