{"id":"CVE-2026-127083","summary":"Huginn from 2026.09.09 before 2026.11.09 SSRF via OUTBOUND_PROXY Bypass","details":"Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.","aliases":["GHSA-98rv-h5p4-9rgr"],"modified":"2026-11-14T02:47:31.487954895Z","published":"2026-11-13T09:34:19.470Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127083.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127083.json"},{"type":"PACKAGE","url":"https://github.com/huginn/huginn"},{"type":"ARTICLE","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/app/models/agents/jira_agent.rb#L108-L109"},{"type":"ARTICLE","url":"https://github.com/huginn/huginn/blob/v2026.11.05.2/lib/outbound_proxy.rb#L38-L42"},{"type":"FIX","url":"https://github.com/huginn/huginn/commit/a6f5fb64ac957f33fc6cdff6ab92884e372857a8"},{"type":"ADVISORY","url":"https://github.com/huginn/huginn/releases/tag/v2026.11.09"},{"type":"ADVISORY","url":"https://github.com/huginn/huginn/security/advisories/GHSA-98rv-h5p4-9rgr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127083"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/huginn-from-2026.09.09-before-2026.11.09-ssrf-via-outbound-proxy-bypass"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/huginn/huginn","events":[{"introduced":"99ba7b05027fca7646d9d6b49752b797d4d4bf73"},{"fixed":"639c050b2bf4e14ef9983012af99dfc1dc68b334"},{"fixed":"a6f5fb64ac957f33fc6cdff6ab92884e372857a8"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2026.09.09"},{"fixed":"2026.11.09"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"a6f5fb64ac957f33fc6cdff6ab92884e372857a8"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v2026.11.09","range":[{"fixed":"639c050b2bf4e14ef9983012af99dfc1dc68b334"}]}]}}],"versions":["v2026.11.05.2","v2026.11.05","v2026.11.01","v2026.10.26","v2026.10.24","v2026.10.14","v2026.10.04","v2026.09.22","v2026.09.21","v2026.09.09"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127083.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}]}