CVE-2026-63769
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- EPSS probability
- 0.41%
- CWE
- CWE-918
- Published
- 2026-07-20
- Last modified
- 2026-09-14
Affected products
- huginn huginn
Weakness type
Related vulnerabilities
- CVE-2026-83548 — A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended altern
- CVE-2026-87595 — Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging socia
- CVE-2026-66842 — BIG-IP and BIG-IQ Configuration utility vulnerability
- CVE-2026-92808 — Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise
- CVE-2026-75754 — Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in A
- CVE-2026-61559 — @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
- CVE-2026-12944 — Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
- CVE-2026-86123 — SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints