CVE-2026-63769

6.3 mediumEPSS 0.4%

Medium (6.3). EPSS 0.4% chance of exploitation in the next 30 days.

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Severity

CVSS 4.0

6.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

7.7 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-07-20
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/huginn/huginn/issues/3679
https://github.com/huginn/huginn/pull/3684
https://github.com/huginn/huginn/releases/tag/v2026.09.09
https://github.com/huginn/huginn/security/advisories/GHSA-f7cq-gj98-cfjp
https://www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-method

Check your stack JSON