Read the docs
TI-2026-42019 Aliases CVE-2026-58404

Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings

Priority LOW 21CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed hugo (gohugoio): v0.163.1Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gohugoiohugov0.162.0 to before v0.163.1v0.163.1Patch availableCNA
  • hugo Vendorgohugoio Affected v0.162.0 to before v0.163.1 Fixed in v0.163.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:*0.162.0 to before 0.163.1Vulnerablegohugoio
  • cpe:2.3:a:gohugo:hugo:*:*:*:*:*:*:*:* Versions 0.162.0 to before 0.163.1 Vulnerable ·gohugoio

Remediation

  • Fix · CNA hugo (gohugoio) Fixed in v0.163.1

Red Hat 1 advisory

  • RHSA-2026:36862 Released 2026-07-08 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images hugo-main@aarch64, hugo-main@src, hugo-main@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:36862

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-58404

References

Patch 1

Advisory 1

Other 2

  • TI-2026-64848 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots CVSS 4.0HIGH 8.7
  • TI-2026-64846 Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks CVSS 4.0HIGH 8.7
  • TI-2026-53153 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant CVSS 4.0CRITICAL 9.3
  • TI-2020-16105 Hugo can execute a binary from the current directory on Windows CVSS 3.1HIGH 8.5
  • TI-2026-64849 Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass CVSS 4.0HIGH 8.6
  • TI-2026-32270 Hugo: Node tool execution allows file system access outside the project directory CVSS 4.0MEDIUM 6.2
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences