Server-Side Request Forgery in Hugo's HTTP Allowlist Mechanism

CVE-2026-10582

What is CVE-2026-10582?

A significant vulnerability exists in Hugo's security management, specifically in how the software evaluates HTTP URLs through its allowlist mechanism. The CheckAllowedHTTPURL function verifies the configured patterns against the URL text but fails to perform hostname resolution at connection time. As a result, URLs that point to loopback, private, or cloud metadata addresses can bypass security checks, allowing an attacker to supply malicious URLs through content fields. This exploitation enables the build process to fetch internal resources, potentially leaking private data within the generated static site output.

References