Hugo SSRF Flaw Lets `resources.GetRemote` Reach Internal and Metadata Endpoints

A high-severity server-side request forgery flaw tracked as CVE-2026-10582 affects Hugo 0.91.0 through 0.165.0. The issue lies in outbound fetches performed by resources.GetRemote, where security.http.urls validates only the supplied URL text and some canonicalized IPv4 variants, but does not resolve hostnames or verify the destination IP at connection time. That gap allows attacker-controlled hostnames to pass policy checks even if they ultimately resolve to loopback, private-network, or cloud-metadata addresses.

If an attacker can influence a URL through front matter, site content, or a CMS field, Hugo’s build process can retrieve internal resources and embed the response into the generated static site, creating a path for data exfiltration through published artifacts. Hugo’s security code already includes SSRF-focused checks such as blocking localhost-style URL patterns, userinfo in URLs, and alternate IPv4 encodings, but the advisory says those protections do not enforce dial-time destination validation. The vulnerability is classified as CWE-918 and has been scored 7.4 CVSS v3.1 and 8.3 CVSS v4.0.