CVE-2026-58404: Hugo SSRF bypass via alternate IPv4 encodings in security.http.urls

CVE-2026-58404 · Severity: medium · CVSS 4 · Published 2026-07-06

Hugo is a popular tool used to build websites from templates. A security flaw in how it handles web addresses allows an attacker to bypass safety filters and force the tool to make unauthorized requests to internal services or private cloud data during the website building process. This could lead to the exposure of sensitive internal configuration data or cloud credentials, especially in automated build environments.

Technologies: github.com/gohugoio/hugo (Go), Hugo. Vendors: Go, Hugo.

Quick answers

Is CVE-2026-58404 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58404 being exploited in the wild.
How severe is CVE-2026-58404?
Medium severity, with a CVSS score of 4, published 6 July 2026.
Which products and versions are affected?
github.com/gohugoio/hugo (Go) SEMVER:introduced=0.162.0,fixed=0.163.1; Hugo >= v0.162.0, < v0.163.1.
Is there a fix for CVE-2026-58404?
Yes. github.com/gohugoio/hugo (Go): upgrade to 0.163.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58404 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58404?
Check whether you run github.com/gohugoio/hugo (Go) or Hugo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/gohugoio/hugo (Go): upgrade to 0.163.1 or later
    go get github.com/gohugoio/hugo@v0.163.1

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Hugo's 'security.http.urls' policy enforcement. The policy was designed to block requests to loopback, internal, and cloud-metadata IPv4 addresses but only validated dotted-decimal notation. Attackers can bypass this by using alternate IPv4 encodings (integer, hex, or octal) which the cgo system resolver still resolves to the restricted addresses. When a template passes an untrusted URL to 'resources.GetRemote', Hugo may perform build-time requests to internal services or cloud metadata endpoints. This bypass also applies to redirect hops. The issue is fixed in v0.163.1 by canonicalizing all IPv4 host encodings to dotted-decimal before policy application.

Affected products

  • gohugoio Hugo >= v0.162.0, < v0.163.1

Identifiers

  • CVE-2026-58404
  • GHSA-r46f-3rpw-hxrv
  • GO-2026-5606

Timeline

  • 2026-06-10: patched: Fix merged into master branch.
  • 2026-06-11: advisory: Release v0.163.1 published.
  • 2026-06-18: disclosed: GitHub Security Advisory GHSA-r46f-3rpw-hxrv published.
  • 2026-07-06: disclosed: CVE-2026-58404 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.