CVE-2026-127083
Received Received - Intake

Server-Side Request Forgery in Huginn Automation Platform

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127083
EUVD
EUVD-2026-125099

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
huginn huginn From 2026.9.9 (inc) to 2026.11.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-127083 is a Server-Side Request Forgery (SSRF) vulnerability in Huginn versions before 2026.11.09. The issue occurs because the OutboundProxy.configure! method only applies the egress proxy to Faraday and Typhoeus requests. Authenticated users can configure agents like JiraAgent or WeiboPublishAgent to send HTTParty, open-uri, or Net::HTTP requests directly to internal services, bypassing the proxy. This allows potential access to internal systems and data exposure.

Detection Guidance

Check if your Huginn version is below v2026.11.09 by running: curl -s https://your-huginn-instance.com/ | grep -i version. Inspect network logs for direct outbound HTTP requests from JiraAgent or WeiboPublishAgent to internal IPs. Use tcpdump or Wireshark to monitor traffic bypassing the proxy.

Impact Analysis

This vulnerability allows authenticated users to send outbound requests to internal services without proxy enforcement. For JiraAgent, responses may be returned as events, exposing sensitive internal data. Attackers could exploit this to access internal systems, perform reconnaissance, or exfiltrate data depending on the services accessible from the Huginn host.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal systems and data exposure, violating confidentiality requirements in GDPR and HIPAA. If sensitive data is accessed or exfiltrated, it may result in non-compliance with these regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade Huginn to v2026.11.09 or later. Restart all Huginn processes after upgrade. Review and rotate sensitive credentials like APP_SECRET_TOKEN if USE_JQ was enabled. Configure network-level egress restrictions to block unauthorized outbound requests until upgraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127083. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...