CVE-2026-100693: Hugo Static Site Generator Auth Bypass

CVE-2026-100693 Overview

CVE-2026-100693 is a case-sensitive validation flaw in the Hugo static site generator. The vulnerability affects security.http.urls IP-literal deny rules in Hugo versions from v0.162.0 before v0.166.0. Attackers can bypass restrictions by supplying mixed-case URL schemes (for example HTTP:// instead of http://) in resources.GetRemote calls. This allows fetches against restricted IP addresses such as localhost and other internal hosts. The weakness is classified as [CWE-178: Improper Handling of Case Sensitivity].

Critical Impact
Attackers can bypass Hugo's HTTP URL allowlist to reach internal services during build, enabling server-side request forgery against localhost and private network resources.

Affected Products

Gohugo Hugo v0.162.0 through v0.165.x
Hugo sites using resources.GetRemote with security.http.urls deny rules
Build environments embedding Hugo as a library for remote resource fetching

Discovery Timeline

2026-09-26 - CVE-2026-100693 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100693

Vulnerability Analysis

Hugo exposes a security.http.urls policy that site owners configure to restrict which URLs the resources.GetRemote function may fetch during site builds. The policy supports IP-literal deny rules intended to block requests to localhost, loopback addresses, and other private ranges. The deny-list enforcement performs case-sensitive matching against the URL scheme component. Attackers who control template inputs or site content can submit URLs with mixed-case schemes such as HTTP://127.0.0.1/ or Http://localhost:8080/admin. The validator does not canonicalize the scheme before comparison, so the request bypasses the deny rule and Hugo issues the outbound HTTP call.

Root Cause

The root cause is improper handling of case sensitivity in scheme normalization. URL schemes are case-insensitive per RFC 3986, but Hugo's filter compares them as raw strings. Any variation in capitalization defeats the deny-list check while remaining a valid URL for the underlying HTTP client.

Attack Vector

Exploitation requires an attacker to influence the URL argument passed to resources.GetRemote at build time. This can occur through user-supplied data model fields, remote data sources, pull requests to a site repository, or compromised upstream content. Once a mixed-case scheme bypasses validation, Hugo contacts the restricted host and returns the response body to the template context, enabling server-side request forgery against metadata services, internal admin panels, or loopback-bound daemons.

No verified proof-of-concept code is published. See the VulnCheck Advisory on Hugo Bypass and the GitHub Security Advisory for additional technical detail.

Detection Methods for CVE-2026-100693

Indicators of Compromise

Outbound HTTP connections from Hugo build processes to loopback or RFC 1918 addresses
Template or content files containing URL schemes with non-lowercase characters such as HTTP://, Https://, or hTTp://
Build logs showing resources.GetRemote fetches returning content from internal hostnames

Detection Strategies

Inspect site repositories and CI/CD pipelines for resources.GetRemote calls that pass unsanitized external input
Audit Hugo build output and verbose logs for HTTP requests whose host component resolves to internal IP ranges
Compare installed Hugo binary version against the 0.166.0 patched release in build images and developer workstations

Monitoring Recommendations

Instrument build runners with egress monitoring to flag HTTP traffic destined for loopback, link-local, or private IP space
Enable network policy logging in container orchestrators used for Hugo builds and alert on blocked internal connection attempts
Track Hugo version drift across repositories using software composition analysis and CI image scanning

How to Mitigate CVE-2026-100693

Immediate Actions Required

Upgrade Hugo to v0.166.0 or later in all build environments, developer workstations, and container images
Audit config.toml, config.yaml, or hugo.toml for security.http.urls entries and confirm they match the patched normalization behavior
Review recent builds for unexpected resources.GetRemote destinations that may indicate exploitation attempts

Patch Information

The Hugo maintainers released the fix in version 0.166.0. The patch normalizes URL schemes to lowercase before applying security.http.urls deny rules. See the GitHub Security Advisory GHSA-pmrv-x7gp-2rjw for complete release details.

Workarounds

Restrict resources.GetRemote inputs to a static allowlist of trusted URLs rather than relying solely on deny rules
Run Hugo builds in isolated network namespaces that block egress to loopback and private IP ranges
Sanitize untrusted template inputs by lowercasing and validating URL schemes before passing them to Hugo functions

bash

# Verify installed Hugo version is patched
hugo version

# Upgrade via common package managers
brew upgrade hugo              # macOS
go install github.com/gohugoio/hugo@v0.166.0   # Go toolchain