CVE-2026-63769 | Huginn through 2022.08.18 contains a server-side request for… | CVSS 7.7 HIGH

Description

Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

Metadata

CVE ID: CVE-2026-63769
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-18 12:34 UTC
Published: 2026-07-20 19:05 UTC
Last updated: 2026-07-20 19:05 UTC
Primary CWE: CWE-918
Server-Side Request Forgery (SSRF)
Vendor / Product: huginn / huginn
Sources: cve.org · NVD

Severity & Metrics

7.7 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
huginn	huginn	—	0 ≤ 2022.08.18

Weakness (CWE)

CWE	Source	Description
CWE-918	cna	Server-Side Request Forgery (SSRF)

CVSS scores (2)

Score	Severity	Version	Source	Vector
7.7	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
6.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

References (3)

Researcher Disclosure https://github.com/huginn/huginn/issues/3679
Pull Request https://github.com/huginn/huginn/pull/3684
https://www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-method