CVE-2026-63769CWE-918ssrf

CVE-2026-63769

High · published July 20, 2026

CVSS v3.1

7.7

EPSS

Percentile

34.7

In the wild

Unconfirmed

What it is

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

The record

Technical detail

CVSS v3.1: 7.7 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00415 · 34.7th percentile
Weakness: CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2026-07-20T23:17Z

References (5)

https://github.com/huginn/huginn/issues/3679 · [email protected]https://github.com/huginn/huginn/pull/3684 · [email protected]https://github.com/huginn/huginn/releases/tag/v2026.09.09 · [email protected]https://github.com/huginn/huginn/security/advisories/GHSA-f7cq-gj98-cfjp · [email protected]https://www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-method · [email protected]

EPSS history

Timeline

20 JUL 19:05Z
Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method
cvelistv5