CVE-2026-63769
Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jul 20, 2026
- Updated
- Sep 24, 2026
- Reserved
- Jul 18, 2026
Description
Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N | VulnCheck |
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
huginnhuginn |
|
References
- Researcher Disclosuretechnical-descriptionexploitissue-tracking
- Pull Requestissue-tracking
- GitHub Security Advisory (GHSA-f7cq-gj98-cfjp)vendor-advisory
- Release Notesrelease-notes
- https://www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-methodthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.