SSRF in Huginn
CVE-2026-63769
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.004 (33.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Huginn — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking, technical-description, exploit)
- disclosure@vulncheck.com (issue-tracking, patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-63769?
- CVE-2026-63769 is a high-severity vulnerability in Huginn, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.7/10. Published 2026-07-20.
- How severe is CVE-2026-63769?
- High severity. CVSS v3 base score is 7.7 out of 10.