# CVE-2026-50134: Hugo SSRF via HTTP redirect bypass in resources.GetRemote

Source: https://junglewise.ai/threats/cve-2026-50134-hugo-ssrf-via-http-redirect-bypass-in-resources-getremote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-50134 · Severity: medium · CVSS 0 · Published 2026-07-06

Hugo, a popular tool for building websites, contains a security flaw in how it fetches data from external servers. While Hugo allows administrators to restrict which websites it can connect to, an attacker could bypass these restrictions by using a web redirect. This could allow the tool to access internal systems or restricted data that should have been blocked by the security policy.

Technologies: [github.com/gohugoio/hugo (Go)](https://junglewise.ai/threats/technologies/github-com-gohugoio-hugo), [Hugo](https://junglewise.ai/threats/technologies/hugo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hugo](https://junglewise.ai/threats/vendors/hugo).

## Quick answers

**Is CVE-2026-50134 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50134 being exploited in the wild.

**How severe is CVE-2026-50134?** Medium severity, with a CVSS score of 0, published 6 July 2026.

**Which products and versions are affected?** github.com/gohugoio/hugo (Go) >= 0.91.0, < 0.162.0, SEMVER:introduced=0.91.0,fixed=0.162.0; Hugo >= 0.91.0, < 0.162.0.

**Is there a fix for CVE-2026-50134?** Yes. github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50134 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50134?** Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gohugoio/hugo (Go): upgrade to 0.162.0 or later

  ```sh
  go get github.com/gohugoio/hugo@v0.162.0
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo's 'resources.GetRemote' function due to improper validation of HTTP redirects. While the initial URL is checked against the 'security.http.urls' allow-list, subsequent 3xx redirect hops were not re-validated in versions prior to 0.162.0. An attacker who controls a permitted host, or can influence its DNS/responses, can redirect Hugo to fetch resources from forbidden targets, including localhost or internal IP addresses. This bypasses host-shape restrictions and security policies intended to constrain network access during builds. The fix, introduced in version 0.162.0, implements a 'CheckRedirect' handler that validates every hop in the redirect chain against the allow-list and limits the chain to 10 hops.

## Affected products

- gohugoio Hugo >= 0.91.0, < 0.162.0

## Identifiers

- CVE-2026-50134
- GHSA-vxgm-5rmg-5w8g
- GO-2026-5681

## Timeline

- 2026-05-26: patched: Version 0.162.0 released
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE-2026-50134 published to NVD

## References

- [https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50](https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50)
- [https://github.com/gohugoio/hugo/releases/tag/v0.162.0](https://github.com/gohugoio/hugo/releases/tag/v0.162.0)
- [https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g](https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g)

## Related threats

- [Hugo path traversal in js.Build and css.Build via ESBuild](https://junglewise.ai/threats/cve-2026-109595-hugo-from-v0-84-0-before-v0-167-0-contains-a-path-traversal)
- [Hugo path traversal in css.Sass import fallback](https://junglewise.ai/threats/cve-2026-109574-hugo-before-v0-167-0-contains-a-path-traversal-vulnerability-in)
- [Hugo stored cross-site scripting in lineAnchors](https://junglewise.ai/threats/cve-2026-100691-hugo-versions-0-75-0-through-0-165-x-contain-a-stored-cross-site)
- [Hugo insufficient permission restriction via TailwindCSS](https://junglewise.ai/threats/cve-2026-89259-hugo-insufficient-permission-restriction-via-tailwindcss)
- [Hugo fenced code block attribute injection](https://junglewise.ai/threats/cve-2026-10618-hugo-fenced-code-block-attribute-injection)