https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:30:14 +0000 https://db.gcve.eu/vuln/cve-2026-73247 <p><strong>Affected:</strong> kestra-io kestra</p> <p>Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra&#39;s core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.</p> <p><strong>Affected:</strong> kestra-io kestra</p> <p>Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra&#39;s core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.</p> https://db.gcve.eu/vuln/cve-2026-73247