CVE-2026-73247

Kestra's CVE-2026-73247 is an SSRF gap in the HttpFunction template function that shipped with the 1.x series. The vulnerability allows an unauthenticated user to trigger arbitrary HTTP requests from the Kestra server—directly to cloud metadata endpoints (169.254.169.254), internal services, or anything else the server's network context can reach. The EPSS score of 0.00296 reflects low current exploitation, likely because Kestra's deployment footprint remains relatively niche—but the severity ceiling is exactly what you'd expect from unrestricted HTTP access in an orchestration layer: cloud credential exfiltration and lateral movement. What makes this值得深思 (worth pondering) is the sediment phenomenon. The pre-2.0.0 qualifier tells you this code ran in production long enough for users to build workflows around it—and more importantly, to treat unrestricted HTTP access from within flows as a feature of the platform rather than a gap. Unhardened code becomes the idiomatic pattern through repetition and dependency, not through security review. The fix in 2.0.0 addresses HttpFunction specifically, but the underlying question is whether the rest of Kestra's codebase has other junction points where user-controlled input reaches network calls without equivalent validation. The deeper failure is architectural proximity. Kestra is built as the connective tissue between systems, and when you make HTTP calls frictionless in your orchestration layer, you're not just shipping a feature—you're creating a guaranteed junction point where this vulnerability class will detonate if the tool gains adoption. The pre-2.0.0 label is largely narrative cover; users deploy whatever version works regardless of stability disclaimers, and those who did during the 1.x window ran exactly the combination that creates blast radius: broad service account permissions plus unrestricted HTTP. For defenders: audit your Kestra deployments for flows that use HttpFunction or similar template functions with user-influenced URIs. Review whether the service account running Kestra has unnecessary network reachability—particularly to cloud metadata services. The fix adds URI validation, but validate that it uses robust allowlisting rather than easily-bypassed regex patterns, given the documented history of SSRF bypasses in similar contexts.

Reviewed through automated stages and approved by a human before publication.