CVE-2026-63769

Name of the Vulnerable Software and Affected Versions Huginn versions prior to 2022.08.19

Description Authenticated users can perform server-side request forgery (SSRF) by submitting crafted URLs. This issue occurs within the fetch url() function of the ScenarioImport class, allowing attackers to make arbitrary HTTP requests. This can be used to probe internal network services, enumerate ports through error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Recommendations Update Huginn to a version later than 2022.08.18. As a temporary mitigation, restrict access to the fetch url() function within ScenarioImport to prevent unauthorized internal requests.