CyberRota Analysis
AI-GeneratedKestra versions prior to 2.0.0 are vulnerable due to improper handling of user-controlled HTTP URI arguments, which can lead to unauthorized access to internal services or cloud metadata. This flaw allows unauthenticated attackers to exploit the orchestration platform, potentially compromising sensitive data and services. Organizations using Kestra should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.