CVE-2026-63769

HighCVSS 7.7

Published: 20/07/2026(UTC)Updated: 14/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

Huginn before 2026.09.09 contains a server-side request forgery (SSRF) vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Risk Assessment

The risk includes unauthorized access to internal network resources, service discovery, and credential theft from cloud metadata, potentially leading to a serious security breach.

Recommendation

Update Huginn to version 2026.09.09 or later immediately and restrict access to the scenario import functionality to trusted users only.

Other vulnerabilities in Huginn

CVE-2026-123094Medium
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them.

Original NVD description (English source)

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS