Skip to content
OpenAdvisories

Package · Maven

io.kestra:core

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-73247

    Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

    Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client…

    kestra-io kestra io.kestra:kestra-core io.kestra:core Maven