Is CVE-2026-5623 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5623 being exploited in the wild.

How severe is CVE-2026-5623?

Medium severity, with a CVSS score of 6.3, published 6 April 2026.

Which products and versions are affected?

Hcengineering Huly Platform 0.7.382.

Is there a fix for CVE-2026-5623?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5623 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5623?

Check whether you run Hcengineering Huly Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5623: hcengineering Huly Platform SSRF in Import Endpoint

CVE-2026-5623 · Severity: medium · CVSS 6.3 · Published 2026-04-06

A security vulnerability has been found in the Huly Platform, an open-source workflow and project management tool. An attacker can trick the system into making unauthorized network requests to internal or external servers. This could allow an attacker to access sensitive internal data or bypass security controls that protect private infrastructure.

Technologies: Hcengineering Huly Platform. Vendors: Hcengineering.

Quick answers

Is CVE-2026-5623 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5623 being exploited in the wild.
How severe is CVE-2026-5623?: Medium severity, with a CVSS score of 6.3, published 6 April 2026.
Which products and versions are affected?: Hcengineering Huly Platform 0.7.382.
Is there a fix for CVE-2026-5623?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5623 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5623?: Check whether you run Hcengineering Huly Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in hcengineering Huly Platform version 0.7.382. The flaw is located within the 'Import Endpoint' component, specifically in the file 'server/front/src/index.ts'. A remote attacker with low privileges can exploit this by sending a crafted request that forces the server to perform unintended network actions. This can be used to scan internal networks, access metadata services, or interact with other internal systems that are not exposed to the public internet. A public exploit (PoC) is reportedly available, and the vendor has not yet provided a patch or official response.

Affected products

hcengineering Huly Platform 0.7.382

Timeline

2026-04-06: disclosed
2026-04-06: advisory: NVD published the CVE record

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.