CVE-2026-56769: Huly Platform - Server-Side Request Forgery via /import Endpoint
Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Huly Platformto a version that resolves this vulnerability.Fixed in 0.7.423Patch 68cbf8a - Compensating control
Restrict network egress from the front pod (where the /import endpoint runs) so it cannot reach internal services that should not be accessible via server-side requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56769?
CVE-2026-56769 has a severity rating of medium with a score of 6.3.
How does CVE-2026-56769 affect the Huly Platform?
CVE-2026-56769 allows authenticated users to exploit the /import endpoint, potentially making arbitrary server requests.
How do I fix CVE-2026-56769?
To fix CVE-2026-56769, upgrade to the latest version of Huly Platform that has been patched for this vulnerability.
What is the exploitability of CVE-2026-56769?
CVE-2026-56769 can be exploited by authenticated users who can supply malicious URLs to the /import endpoint.
What type of vulnerability is CVE-2026-56769?
CVE-2026-56769 is classified as a Server-Side Request Forgery (SSRF) vulnerability.