Is CVE-2026-50134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50134 being exploited in the wild.

How severe is CVE-2026-50134?

Medium severity, with a CVSS score of 0, published 6 July 2026.

Which products and versions are affected?

github.com/gohugoio/hugo (Go) >= 0.91.0, = 0.91.0, < 0.162.0.

Is there a fix for CVE-2026-50134?

Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50134 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50134?

Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50134: Hugo SSRF via HTTP redirect bypass in resources.GetRemote

Q: Is there a fix for CVE-2026-50134?

Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50134 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50134?

Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50134 · Severity: medium · CVSS 0 · Published 2026-07-06

Hugo, a popular tool for building websites, contains a security flaw in how it fetches data from external servers. While Hugo allows administrators to restrict which websites it can connect to, an attacker could bypass these restrictions by using a web redirect. This could allow the tool to access internal systems or restricted data that should have been blocked by the security policy.

Technologies: github.com/gohugoio/hugo (Go), Hugo. Vendors: Go, Hugo.

Quick answers

Is CVE-2026-50134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50134 being exploited in the wild.
How severe is CVE-2026-50134?: Medium severity, with a CVSS score of 0, published 6 July 2026.
Which products and versions are affected?: github.com/gohugoio/hugo (Go) >= 0.91.0, < 0.162.0, SEMVER:introduced=0.91.0,fixed=0.162.0; Hugo >= 0.91.0, < 0.162.0.
Is there a fix for CVE-2026-50134?: Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50134 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50134?: Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later
```
go get github.com/gohugoio/hugo@v0.162.0
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo's 'resources.GetRemote' function due to improper validation of HTTP redirects. While the initial URL is checked against the 'security.http.urls' allow-list, subsequent 3xx redirect hops were not re-validated in versions prior to 0.162.0. An attacker who controls a permitted host, or can influence its DNS/responses, can redirect Hugo to fetch resources from forbidden targets, including localhost or internal IP addresses. This bypasses host-shape restrictions and security policies intended to constrain network access during builds. The fix, introduced in version 0.162.0, implements a 'CheckRedirect' handler that validates every hop in the redirect chain against the allow-list and limits the chain to 10 hops.

Affected products

gohugoio Hugo >= 0.91.0, < 0.162.0

Identifiers

CVE-2026-50134
GHSA-vxgm-5rmg-5w8g
GO-2026-5681

Timeline

2026-05-26: patched: Version 0.162.0 released
2026-05-28: advisory: GitHub Security Advisory published
2026-07-06: disclosed: CVE-2026-50134 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.