CVE-2026-73247 is a server-side request forgery (SSRF) vulnerability in Kestra, an open-source event-driven orchestration platform. In versions prior to 2.0.0, the http() function in core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java does not restrict user-controlled URI inputs, allowing unauthenticated attackers to craft requests that reach internal network resources or cloud metadata endpoints. The vulnerability arises because the URI argument is passed directly to URI.create() and the server-side HTTP client without validation or filtering of sensitive network ranges.

An unauthenticated attacker can exploit this SSRF vulnerability to cause the Kestra server to make HTTP requests to internal services or cloud metadata endpoints. This can lead to unauthorized access to sensitive internal resources or cloud instance metadata, potentially exposing confidential information. The vulnerability has a high severity with a CVSS score of 8.6, reflecting its network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Kestra server to trusted users and networks. Monitor for suspicious flow imports and consider network-level controls to block unauthorized internal HTTP requests originating from the Kestra server.