CVE-2026-56769
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Huly Platform through version 0.7.423 contains an authenticated server-side request forgery (SSRF) vulnerability in the /import endpoint of the front pod. It allows workspace users to make arbitrary server requests by supplying malicious URLs.
Risk Assessment
Attackers can exploit this vulnerability to access internal services, exfiltrate responses, and replay credentials against backend systems, potentially compromising the confidentiality and integrity of organizational data.
Recommendation
Immediately update Huly Platform to a version containing the fix (commit 68cbf8a) and restrict access to the /import endpoint to trusted users only.
Other vulnerabilities in Huly Platform
See all- CVE-2026-12213Medium
Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-12212Medium
In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-5623Medium
Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.