CVE-2026-10582

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10582", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-01T18:07:48.223Z", "datePublished": "2026-08-24T10:29:09.560Z", "dateUpdated": "2026-08-24T18:59:36.842Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T11:13:11.477Z"}, "datePublic": "2026-08-12T00:00:00.000Z", "title": "Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation", "descriptions": [{"lang": "en", "value": "Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "gohugoio", "product": "hugo", "collectionURL": "https://github.com/gohugoio/hugo", "defaultStatus": "unaffected", "versions": [{"version": "0.91.0", "lessThanOrEqual": "0.165.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.91.0", "versionEndIncluding": "0.165.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "baseScore": 8.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "references": [{"url": "https://github.com/gohugoio/hugo", "tags": ["product"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go", "tags": ["technical-description"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation"}], "credits": [{"lang": "en", "value": "Michael Holmquist", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T18:59:29.076098Z", "id": "CVE-2026-10582", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T18:59:36.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10582", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T18:59:29.076098Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T18:59:33.312Z"}}], "cna": {"title": "Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation", "credits": [{"lang": "en", "type": "finder", "value": "Michael Holmquist"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gohugoio", "product": "hugo", "versions": [{"status": "affected", "version": "0.91.0", "versionType": "semver", "lessThanOrEqual": "0.165.0"}], "collectionURL": "https://github.com/gohugoio/hugo", "defaultStatus": "unaffected"}], "datePublic": "2026-08-12T00:00:00.000Z", "references": [{"url": "https://github.com/gohugoio/hugo", "tags": ["product"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go", "tags": ["technical-description"]}, {"url": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation", "name": "VulnCheck Advisory: Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.165.0", "versionStartIncluding": "0.91.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T11:13:11.477Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10582", "state": "PUBLISHED", "dateUpdated": "2026-08-24T18:59:36.842Z", "dateReserved": "2026-06-01T18:07:48.223Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T10:29:09.560Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/gohugoio/hugo", "defaultStatus": "unaffected", "product": "hugo", "vendor": "gohugoio", "versions": [{"lessThanOrEqual": "0.165.0", "status": "affected", "version": "0.91.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out."}, {"lang": "es", "value": "La lista de permitidos 'security.http.urls' de Hugo es el \u00fanico control sobre las recuperaciones salientes realizadas por 'resources.GetRemote', y solo inspecciona el texto de la URL. 'CheckAllowedHTTPURL' en 'config/security/securityConfig.go' aplica la lista de patrones configurada y luego vuelve a verificar una forma canonizada de un host IPv4 entero, hexadecimal u octal, pero nunca resuelve el nombre de host y nunca inspecciona la direcci\u00f3n a la que el 'cliente HTTP' realmente se conecta. El 'cliente' construido en 'resources/resource_factories/create/create.go' no instala ning\u00fan 'hook' en tiempo de conexi\u00f3n, por lo que tampoco se realiza ninguna verificaci\u00f3n en el momento de la conexi\u00f3n. Un nombre de host que se resuelve en una direcci\u00f3n de 'loopback', privada o de metadatos de la nube, por lo tanto, satisface la pol\u00edtica, y el cuerpo de la respuesta se incrusta en el sitio generado. Un 'atacante' que puede proporcionar una URL a trav\u00e9s del contenido, por ejemplo, un campo de 'front-matter' o un campo de 'CMS', puede hacer que la compilaci\u00f3n recupere un 'endpoint' interno y publique la respuesta en la salida est\u00e1tica, por lo que el artefacto de compilaci\u00f3n en s\u00ed mismo extrae los datos."}], "id": "CVE-2026-10582", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10582", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T18:59:29.076098Z", "version": "2.0.3"}}]}, "published": "2026-08-24T11:16:38.233", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/gohugoio/hugo"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hugo: github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) leading to information disclosure.", "id": "2521803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521803"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Hugo. The `security.http.urls` allowlist, which controls outbound fetches, does not adequately validate the destination address of URLs. This vulnerability allows a remote attacker to supply a specially crafted URL that resolves to internal network resources. As a result, the Hugo build process can fetch internal endpoints, and the sensitive response data may be embedded and published within the generated static site, leading to information disclosure."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, ensure that the Hugo `security.http.urls` allowlist is strictly configured to permit outbound requests only to explicitly trusted external domains. Implement network egress filtering to prevent Hugo from initiating connections to internal, loopback, or private IP address ranges. This can be achieved by configuring firewall rules or network policies to block outbound traffic from the Hugo environment to RFC1918 addresses and other internal network segments."}, "name": "CVE-2026-10582", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "hugo", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-rhel9", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhoso-operators/openstack-operator-bundle", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-08-24T10:29:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-10582\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-10582\nhttps://github.com/gohugoio/hugo\nhttps://github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go\nhttps://github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go\nhttps://www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.91.0,0.165.0]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "hugo", "source": "cna", "vendor": "gohugoio"}, "product": "hugo", "vendor": "gohugo"}], "created": "2026-08-24T11:30:03.585634+00:00", "updated": "2026-08-24T21:00:12.166900+00:00", "vendors": ["gohugo", "gohugo$PRODUCT$hugo"]}