CVE-2026-127083
Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the e
CVSS
6.4
Medio
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-918
Sin historial EPSS suficiente todavía.
Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.
- github.comhttps://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jira_agent.rb#L108-L109
- github.comhttps://github.com/huginn/huginn/blob/v2026.11.05.2/lib/outbound_proxy.rb#L38-L42
- github.comhttps://github.com/huginn/huginn/commit/a6f5fb64ac957f33fc6cdff6ab92884e372857a8
- github.comhttps://github.com/huginn/huginn/releases/tag/v2026.11.09
- github.comhttps://github.com/huginn/huginn/security/advisories/GHSA-98rv-h5p4-9rgr
- www.vulncheck.comhttps://www.vulncheck.com/advisories/huginn-from-2026.09.09-before-2026.11.09-ssrf-via-outbound-proxy-bypass
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-821026.4 MED—
———IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.6hCVE-2026-1101945.4 MED—
———IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.6hCVE-2026-1272176.4 MED—
———Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.7hCVE-2026-1272148.5 ALT—
———Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.8hCVE-2026-1290944.7 MED—
———@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine.12hCVE-2026-821753.8 BAJ—
———Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance.11h