The vulnerability manifests in the Pebble http() function within Kestra's core code. Prior to version 2.0.0, the function accepts a user‑controlled URI and passes it directly to the URI.create method and the server‑side HTTP client. No validation or restriction is performed to block private, loopback, or link‑local destinations, which allows an unauthenticated attacker to cause the application to request arbitrary internal or cloud‑metadata endpoints.

Affected systems are instances of the Kestra orchestration platform before version 2.0.0. The product, an open‑source event‑driven workflow engine, is maintained by kestra‑io:kestra. The SSRF flaw exists in all releases released prior to the 2.0.0 milestone, and therefore any deployment running those versions is susceptible.

The CVSS score of 8.6 indicates high severity, yet the EPSS score of <1% suggests that exploitation opportunities are currently rare. The vulnerability is not listed in CISA's KEV catalog. Attackers can trigger the SSRF by creating or importing a flow that invokes the http() function with a crafted URI; because authentication is not required for flow import in the affected builds, the attacker can leverage this vector to reach internal network services or cloud‑metadata endpoints, potentially leaking secrets or executing actions with the application’s permissions.