CVE-2026-127083: Huginn from 2026.09.09 before 2026.11.09 SSRF via OUTBOUND_PROXY Bypass
Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Huginnto a version that resolves this vulnerability.Fixed in 2026.11.09
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Huginn user who can configure a JiraAgent or WeiboPublishAgent can exploit it. The attacker does not need user interaction and can cause the server to make direct requests to internal services.
Does configuring OUTBOUND_PROXY fully protect affected deployments?
No. In affected versions, OutboundProxy.configure! applies the proxy only to Faraday and Typhoeus. Requests made through HTTParty, open-uri, or Net::HTTP by the affected agents can bypass the configured egress proxy.
What information can an attacker obtain through this flaw?
JiraAgent can return data from requested internal services as Huginn events. This can expose response data from services reachable by the Huginn server.
Which versions are affected?
Huginn versions from 2026.09.09 before 2026.11.09 are affected.