CVE-2026-73247 kestra-io CVE debrief

Who should care

Defenders responsible for Kestra instances, especially those exposed to untrusted networks, should assess their exposure and take necessary actions to mitigate this vulnerability. This includes verifying the exposure of Kestra instances, restricting access to internal services, and updating to version 2.0.0 or later. Additionally, defenders should review compensating controls for exposed systems and track exceptions and remediation efforts.

Why it matters

CVE-2026-73247 is a high-severity vulnerability in Kestra that allows unauthenticated attackers to access internal services or cloud metadata. Defenders should verify exposure of Kestra instances, restrict access to internal services, and update to version 2.0.0 or later.

• Potential access to internal services or cloud metadata
• Verification of Kestra instance exposure to untrusted networks
• Restriction of access to internal services
• Update Kestra to version 2.0.0 or later

Technical summary

Kestra's HttpFunction.java passes user-controlled http() uri arguments to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations. This allows an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata. The vulnerability is due to the lack of restrictions on private, loopback, or link-local destinations, which could allow an attacker to access internal services or cloud metadata. Defenders should prioritize verifying exposure of Kestra instances to untrusted networks and restrict access to internal services.

Defensive priority

Defenders should prioritize verifying exposure of Kestra instances to untrusted networks and restrict access to internal services.

Recommended defensive actions

• Verify Kestra instance exposure to untrusted networks
• Restrict access to internal services
• Review and update Kestra to version 2.0.0 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description and source reference indicate that Kestra's HttpFunction.java allows user-controlled URI creation without restrictions, potentially leading to internal service access. The vulnerability is exacerbated by the lack of restrictions on private, loopback, or link-local destinations, which could allow an attacker to access internal services or cloud metadata. Defenders should verify the exposure of Kestra instances to untrusted networks and restrict access to internal services.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.