CVE-2026-10582: Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resourcefactories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Hugo builds are exposed when they use resources.GetRemote with security.http.urls configured and an attacker can influence a fetched URL through content, such as a front-matter or CMS field. The risk is greatest where the build environment can reach internal services, loopback addresses, or cloud metadata endpoints.
Does the configured URL allowlist prevent this attack?
No. The allowlist evaluates URL text and certain canonicalized numeric IPv4 forms, but it does not resolve hostnames or validate the destination address reached by the HTTP client. A permitted hostname can resolve to a loopback, private, or cloud-metadata address.
What does an attacker need to exploit it?
The attacker needs to supply or control a URL consumed by resources.GetRemote during a Hugo build. No authentication to the target internal service is described as necessary, but successful exploitation depends on the build system being able to connect to the target endpoint.
What is the impact if exploitation succeeds?
The build can fetch an internal endpoint and embed its response body into generated static site output. This allows data reachable from the build environment to be exfiltrated through the published build artifact.