Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-127083

Huginn from 2026.09.09 before 2026.11.09 SSRF via OUTBOUND_PROXY Bypass

Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Huginn
Products
Huginn
CVE-2026-127082

Huginn before 2026.11.09 Information Exposure via JqAgent jq env Builtin

Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Huginn
Products
Huginn
CVE-2026-123094

Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Huginn
Products
Huginn
CVE-2026-63769

Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, and access cloud metadata endpoints to retrieve sensitive credentials.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Huginn
Products
Huginn