CVE-2026-63769

7.7 Élevée

Publiée le 20/07/2026 à 21:17 · Modifiée le 14/09/2026 à 22:16 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Traduire en français

Produits concernés

huginn

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.7 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/huginn/huginn/issues/3679
https://github.com/huginn/huginn/pull/3684
https://github.com/huginn/huginn/releases/tag/v2026.09.09
https://github.com/huginn/huginn/security/advisories/GHSA-f7cq-gj98-cfjp
https://www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-method

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories