Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck
CVE-2026-63769Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
High 7.7
In plain English
A high-severity server-side request forgery in huginn from huginn. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 64.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- Researcher Disclosure technical-description, exploit, issue-tracking
- Pull Request issue-tracking
- GitHub Security Advisory (GHSA-f7cq-gj98-cfjp) vendor-advisory
- Release Notes release-notes
- https://www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-method third-party-advisory