Description

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-11T22:19:05.417Z",
  "pubdate": "2026-08-11T22:19:05.417Z",
  "executiveSummary": "An unauthenticated Server-Side Request Forgery vulnerability exists in Kestra prior to version 2.0.0. The vulnerability resides in the core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java component, where user-controlled URI arguments are passed directly to URI.create() and the underlying server-side HTTP client without proper validation or restriction against private, loopback, or link-local destinations. An unauthenticated attacker can exploit this flaw by importing and executing a crafted workflow that forces the orchestration platform to initiate outbound HTTP requests to internal network services, sensitive infrastructure endpoints, or cloud metadata services. The potential impact includes unauthorized access to internal systems, leakage of sensitive environmental or configuration data, and potential lateral movement within the affected network environment. Exploitation requires the ability to create and execute flows within the Kestra platform, but bypasses authentication requirements entirely if the instance permits unauthenticated flow management or import operations.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation and a lack of destination filtering within the HttpFunction component of the Kestra orchestration platform. Specifically, the vulnerable code located at core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java accepts a user-controlled URI argument via the http() function in Pebble templates and passes it directly to the Java URI.create() method and the server-side HTTP client.\nBecause the application fails to enforce restrictions against private IP address ranges (RFC 1918), loopback addresses (127.0.0.1, ::1), link-local addresses (169.254.169.254), or other non-routable and internal destinations, an attacker can manipulate the URI parameter to target internal infrastructure. The attack flow begins with an unauthenticated malicious actor leveraging flow creation or import capabilities to submit a specially crafted Kestra flow definition containing the exploiting Pebble template function. Upon execution of the flow by the orchestration engine, the HttpFunction evaluates the malicious expression and instructs the server-side HTTP client to dispatch a request to the specified internal resource.\nThe network exposure depends on the deployment architecture of the Kestra instance, but typically allows the server to act as a proxy into isolated internal network segments where cloud metadata services, internal databases, or microservices reside. The payload behavior involves directing HTTP GET, POST, or other method requests to sensitive local endpoints, potentially capturing response data and exposing it within execution logs or workflow outputs. Affected versions include all Kestra deployments prior to version 2.0.0. Prerequisites for exploitation include network access to the Kestra API or user interface capable of submitting flow configurations, and the absence of upstream network-level egress filtering that would otherwise restrict the server from communicating with internal destinations."
}