CVE-2026-63769: Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63769?
The severity of CVE-2026-63769 is high with a score of 7.7.
How do I fix CVE-2026-63769?
To fix CVE-2026-63769, update Huginn to a version released after 2022.08.18 that addresses this SSRF vulnerability.
What impact does CVE-2026-63769 have on my system?
CVE-2026-63769 allows authenticated users to perform server-side request forgery attacks, potentially leading to exposure of internal services.
Who is affected by CVE-2026-63769?
CVE-2026-63769 affects all users of Huginn versions prior to 2022.08.18.
What type of vulnerability is CVE-2026-63769?
CVE-2026-63769 is classified as a Server-Side Request Forgery (SSRF) vulnerability.