CVE-2026-63769
Received Received - Intake

Server-Side Request Forgery in Huginn ScenarioImport

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63769
EUVD
EUVD-2026-46072

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Huginn through 2022.08.18 has a server-side request forgery (SSRF) vulnerability in the ScenarioImport component's fetch_url method. Authenticated users can submit crafted URLs to make arbitrary HTTP requests. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to steal sensitive credentials.

Detection Guidance

Monitor network traffic for outbound HTTP requests originating from your Huginn server to internal or unexpected external addresses. Check logs for ScenarioImport fetch_url failures or unusual URL patterns. Use tools like curl or wget to test if the server can be coerced into making requests to internal hosts or cloud metadata endpoints.

Impact Analysis

An attacker with a valid Huginn account can exploit this to map your internal network, connect to unexposed services, and retrieve sensitive data like IAM credentials from cloud metadata endpoints. Error responses may reveal open ports, aiding further attacks. Non-admin users can also exploit this vulnerability.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches if exploited, resulting in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Huginn to a version that includes PR #3684 or later, which hardens URL validation and fetch mechanisms. If upgrading is not possible, restrict network access for the Huginn server, implement allowlists for permitted domains, and enforce strict timeout and size limits on HTTP requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart