Loading vulnerability…
SSRF in Hugo resources.GetRemote
CVE-2026-10582 is a server-side request forgery vulnerability affecting Hugo versions 0.91.0 through 0.165.0. The security.http.urls allowlist used to control outbound requests from resources.GetRemote validates URL text and canonicalized integer, hexadecimal, and octal IPv4 representations, but does not resolve hostnames or validate the address ultimately selected by the HTTP client. No destination validation is performed at connection time. Consequently, an apparently permitted hostname can resolve to a loopback, private-network, or cloud-metadata address and bypass the intended outbound-fetch policy. The retrieved response is incorporated into generated static-site output.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can induce the Hugo build environment to request internal services accessible from that environment, including loopback services, private-network endpoints, and cloud metadata services. Response content from reachable sensitive endpoints can be embedded in the generated static site and exposed through the published build artifact, resulting in confidentiality loss and cross-scope data exfiltration.
If you can’t patch tonight, do this now.
Do not treat security.http.urls URL-pattern allowlisting as sufficient SSRF protection for untrusted inputs. Restrict or disable untrusted control of URLs passed to resources.GetRemote. Isolate build workers and apply network-layer egress filtering, including DNS-aware controls where feasible, to prevent access to internal services and metadata endpoints. Avoid embedding remotely fetched content into build artifacts when the remote URL may be content-controlled.
Patch, then assume compromise.
Upgrade Hugo to a vendor-fixed release when available. Until then, remove or tightly constrain uses of resources.GetRemote where its URL argument can be influenced by untrusted content. Enforce egress policy from build environments that denies access to loopback, private and otherwise sensitive internal address ranges, and cloud metadata services.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.