HUGINN · CVE-2026-127083 · Other
NO FIX YET · SEE WHAT TO DO
Huginn applies its outbound egress proxy only to some HTTP libraries, so a logged-in user can make JiraAgent or WeiboPublishAgent send requests straight to internal services. JiraAgent returns the response data as events, so the attacker can read what comes back.
first public Nov 10, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Huginn instances in the affected range where users can create JiraAgent or WeiboPublishAgent agents. The egress proxy is bypassed for HTTParty, open-uri and Net::HTTP requests, so instances whose agents can reach internal networks are exposed. Instances where only trusted administrators have accounts, or where the network blocks internal access, carry less risk.
Not affected if auth-required, no-jira-or-weibo-agents
Who cares huginn, ruby, self-hosted
2026.09.09 before 2026.11.09).2026.11.09 or later (fixed version per the NVD description).Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.