Kestra SSRF vulnerability via Pebble http() function allows internal access

The GitHub Security Advisory database has disclosed a high-severity vulnerability in Kestra OSS, tracked as GHSA-r56g-q4p6-m3p6. This issue arises from the Pebble template engine's `http()` function, which accepts user-controlled URLs without validation. The flaw enables Server-Side Request Forgery (SSRF) attacks, allowing unauthenticated attackers to access internal services, cloud metadata endpoints like AWS 169.254.169.254, and localhost services. The vulnerability affects all deployments with default configurations.

The root cause lies in the absence of URL validation, IP filtering, and scheme restrictions in the `HttpFunction.java` implementation. Additionally, the function is registered unconditionally without feature flags, and tenant validation does not enforce authentication. A proof-of-concept demonstrates how an attacker can import a malicious Flow YAML and execute it to exfiltrate sensitive data.

Operators should carefully evaluate the impact of this vulnerability before upgrading or deploying Kestra OSS. Systems running on default configurations are particularly exposed, and any workflows relying on the `http()` function could be exploited. It is crucial to assess whether internal services or cloud metadata endpoints are accessible from the affected environment and to implement mitigations such as network-level restrictions or custom validation layers. This vulnerability highlights the importance of scrutinizing default configurations and ensuring that user-controlled inputs are properly sanitized.