CVE-2026-10582

🗓️ 24 Aug 2026 10:29:09Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Hugo SSRF via security.http.urls allowlist not resolving hostnames, leaking internal data in output.

Reporter	Title	Published	Views	Family All 17
Cvelist	CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation	24 Aug 202610:29	–	cvelist
Debian CVE	CVE-2026-10582	24 Aug 202610:29	–	debiancve
EUVD	EUVD-2026-64775	24 Aug 202610:29	–	euvd
Mend	CVE-2026-10582	24 Aug 202610:29	–	mend
NVD	CVE-2026-10582	24 Aug 202611:16	–	nvd
osv_debian	DEBIAN-CVE-2026-10582	24 Aug 202611:16	–	osv_debian
osv_rhsa	RHSA-2026:66266 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update	10 Sep 202610:17	–	osv_rhsa
osv_ubuntu	UBUNTU-CVE-2026-10582	24 Aug 202611:16	–	osv_ubuntu
Positive Technologies	PT-2026-80795	24 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-10582: Server-Side Request Forgery (SSRF)	24 Aug 202600:00	–	rapid7

Vulners

CNA

Node

gohugoio hugoRange0.91.0–0.165.0

[
  {
    "vendor": "gohugoio",
    "product": "hugo",
    "collectionURL": "https://github.com/gohugoio/hugo",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0.91.0",
        "lessThanOrEqual": "0.165.0",
        "status": "affected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/gohugoio/hugo/blob/v0.165.0/resources/resource_factories/create/create.go
github	www.github.com/gohugoio/hugo
github	www.github.com/gohugoio/hugo/blob/v0.165.0/config/security/securityConfig.go
vulncheck	www.vulncheck.com/advisories/hugo-through-server-side-request-forgery-via-security-http-urls-lacking-destination-address-validation

Parameter	Position	Path	Description	CWE
URL	request body	resources.GetRemote	The resources.GetRemote function fails to validate that the resolved IP address of a provided URL is not a loopback, private, or cloud-metadata address, allowing for SSRF during the build process.	CWE-918

12 Oct 2026 15:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.4

CVSS 48.3

EPSS0.00315

SSVC

CWE-918