CVE-2026-91079: Huly Platform through 0.7.426 SSRF via Print Service
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Huly Platformto a version that resolves this vulnerability.Fixed in 0.7.426
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Huly workspace member can exploit it. The exposed functionality is the print endpoint, which accepts URLs for Puppeteer to render.
What can an attacker reach through the vulnerable endpoint?
An attacker can provide arbitrary URLs and cause the server-side print service to request them. This can enable access to internal network hosts and metadata services, with the rendered result returned as a downloadable PDF or image.
Are unauthenticated internet users able to exploit this directly?
The available information identifies authenticated workspace membership as the required privilege. It does not indicate that unauthenticated users can invoke the vulnerable print endpoint.
What configuration condition causes the issue?
The print service lacks hostname allowlist validation for URLs submitted to the print endpoint. The provided data does not describe a configuration-based mitigation or workaround.