CVE-2026-91079
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
Risk Assessment
An authenticated attacker can access internal services and network resources, including cloud metadata, potentially leading to credential leakage. The risk is especially high in cloud environments.
Recommendation
Update Huly Platform to a version newer than 0.7.426 that includes hostname allowlist validation. Until then, restrict access to the print endpoint and segment the network to prevent access to metadata services.
Other vulnerabilities in Huly Platform
See all- CVE-2026-56769High
Huly Platform through version 0.7.423 contains an authenticated server-side request forgery (SSRF) vulnerability in the /import endpoint of the front pod. It allows workspace users to make arbitrary server requests by supplying malicious URLs.
- CVE-2026-12213Medium
Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-12212Medium
In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-5623Medium
Huly Platform (hcengineering) version 0.7.382 has a server-side request forgery vulnerability in the Import endpoint at server/front/src/index.ts. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS