CVE-2026-56769
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
Huly Platform through version 0.7.423 contains an authenticated server-side request forgery (SSRF) vulnerability in the /import endpoint that allows workspace users to make arbitrary server requests.
Risk Assessment
Attackers can exploit this vulnerability by supplying malicious URLs, potentially leading to internal data exfiltration and credential replay against backend systems.
Recommendation
It is recommended to update the Huly platform to a version containing the fix and to monitor and restrict access to the /import endpoint.
Original NVD description (English source)
Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.