Executive brief
Hugo is a popular tool used to build websites from templates. A security flaw in how it handles web addresses allows an attacker to bypass safety filters and force the tool to make unauthorized requests to internal services or private cloud data during the website building process. This could lead to the exposure of sensitive internal configuration data or cloud credentials, especially in automated build environments.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo's 'security.http.urls' policy enforcement. The policy was designed to block requests to loopback, internal, and cloud-metadata IPv4 addresses but only validated dotted-decimal notation. Attackers can bypass this by using alternate IPv4 encodings (integer, hex, or octal) which the cgo system resolver still resolves to the restricted addresses. When a template passes an untrusted URL to 'resources.GetRemote', Hugo may perform build-time requests to internal services or cloud metadata endpoints. This bypass also applies to redirect hops. The issue is fixed in v0.163.1 by canonicalizing all IPv4 host encodings to dotted-decimal before policy application.
Affected products
- gohugoio Hugo >= v0.162.0, < v0.163.1
Timeline
- 2026-06-10: patched: Fix merged into master branch.
- 2026-06-11: advisory: Release v0.163.1 published.
- 2026-06-18: disclosed: GitHub Security Advisory GHSA-r46f-3rpw-hxrv published.
- 2026-07-06: disclosed: CVE-2026-58404 published to NVD.