Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2026-56769Huly Platform - Server-Side Request Forgery via /import Endpoint

High 8.5

In plain English

A high-severity server-side request forgery in platform from hcengineering. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.

Affected products (as reported)

Vendor	Product	Versions
hcengineering	platform	0 – through 0.7.423

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

Researcher Disclosure technical-description, exploit
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/huly-platform-server-side-request-forgery-via-import-endpoint third-party-advisory