CVE-2026-10582
Received Received - Intake

Hugo Static Site Generator Outbound Request Bypass

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-10582
EUVD
EUVD-2026-64775

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hugo static_site_generator *
gohugoio hugo From 0.91.0 (inc) to 0.165.0 (inc)
gohugoio hugo 0.165.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Hugo versions 0.91.0 through 0.165.0. The security.http.urls allowlist only checks URL text and does not resolve hostnames or inspect the actual IP address the HTTP client connects to. This allows attackers to bypass restrictions by providing URLs that resolve to loopback, private, or cloud-metadata addresses, enabling them to fetch internal endpoints and embed sensitive responses in the generated static site.

Detection Guidance

To detect this vulnerability, inspect Hugo's configuration for security.http.urls allowlist settings. Check if the allowlist properly validates resolved hostnames and IP addresses, not just URL text. Review build logs for outbound HTTP requests to unexpected internal or private addresses.

Impact Analysis

An attacker who can supply a URL through content, such as a front-matter field or CMS field, can make the build fetch an internal endpoint and publish the response in the static output. This means the build artifact itself could carry internal data out, potentially exposing sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized internal data being embedded in public build artifacts could result in data breaches and non-compliance with these regulations.

Mitigation Strategies

Upgrade Hugo to a patched version beyond 0.165.0. Tighten security.http.urls allowlist to explicitly block loopback, private, and cloud-metadata IP ranges. Implement network-level controls to prevent outbound connections to internal endpoints during builds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart