High severity7.7NVD Advisory· Published Jul 20, 2026· Updated Sep 14, 2026

CVE-2026-63769

Description

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

hugin/huginllm-fuzzy
Range: <2026.09.09

Patches

Vulnerability mechanics

References

github.com/huginn/huginn/issues/3679nvd
github.com/huginn/huginn/pull/3684nvd
github.com/huginn/huginn/releases/tag/v2026.09.09nvd
github.com/huginn/huginn/security/advisories/GHSA-f7cq-gj98-cfjpnvd
www.vulncheck.com/advisories/huginn-ssrf-via-scenarioimport-fetch-url-methodnvd

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000