🚨High - Kestra Unauthenticated SSRF via http() Function (CVE-2026-73247) Kestra before 2.0.0 passes the user-controlled uri argument of its http() function to the server-side HTTP client without blocking private, loopback, or link-local addresses. An unauthenticated attacker can import and run a flow that makes the Kestra server reach internal services or the cloud metadata endpoint. On cloud-hosted instances this can expose internal data and IAM role credentials from the metadata service, making it a pivot into the wider cloud environment. Impact is to confidentiality. CVSS 8.6. 👉Upgrade Kestra to 2.0.0, and restrict server egress and access to the cloud metadata endpoint.
Post summary
The post discloses a high‑severity unauthenticated SSRF in Kestra before version 2.0.0, details technical aspects and CVSS, and recommends upgrading and tightening egress to mitigate the risk.