CVE-2026-10582: Hugo SSRF Vulnerability

CVE-2026-10582 Overview

CVE-2026-10582 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Hugo, the static site generator maintained by the gohugoio project. The flaw resides in Hugo's security.http.urls allowlist, which is the sole control governing outbound HTTP fetches performed by the resources.GetRemote template function. The allowlist validates only the textual form of a URL and never resolves the destination hostname. A hostname that appears external but resolves to a loopback, private, or cloud metadata address bypasses the policy and returns data that Hugo embeds into the generated site.

Critical Impact
An attacker who controls a URL passed to resources.GetRemote (for example through front-matter or a CMS-managed field) can force Hugo builds to fetch internal endpoints such as 169.254.169.254 and publish the response in the static output, exfiltrating cloud metadata, credentials, or intranet content.

Affected Products

Hugo static site generator (gohugoio/hugo)
Hugo builds using resources.GetRemote with user-influenced URLs
Hugo pipelines integrated with CMS or content sources supplying remote URLs

Discovery Timeline

2026-08-24 - CVE-2026-10582 published to the National Vulnerability Database
2026-08-24 - Last updated in the NVD database

Technical Details for CVE-2026-10582

Vulnerability Analysis

Hugo enforces outbound HTTP restrictions through the CheckAllowedHTTPURL function in config/security/securityConfig.go. The function applies the configured regular-expression allowlist against the URL text and then re-checks a canonicalised form of integer, hex, or octal IPv4 hosts. It does not resolve DNS names to an IP address, and it does not consult the address that the HTTP client eventually connects to.

The HTTP client constructed in resources/resource_factories/create/create.go installs no dial-time hook. No Control callback on the transport's dialer inspects the resolved address before the TCP connection completes. A hostname that resolves to 127.0.0.1, 10.0.0.0/8, 169.254.169.254, or another sensitive destination passes the string-level allowlist and returns content that Hugo splices into the generated site.

Root Cause

The validation gap stems from performing policy decisions on syntactic URL data rather than on the resolved network destination. Hugo's allowlist assumes that a URL string uniquely identifies an endpoint, an assumption that breaks under DNS rebinding, attacker-controlled DNS records, and CNAMEs pointing at internal ranges. The absence of a dial-time hook means the policy layer and the network layer never share the resolved IP.

Attack Vector

Exploitation requires an attacker to influence a URL passed to resources.GetRemote. Content sources such as Markdown front-matter, JSON data files, or upstream CMS fields are common injection points. The attacker registers a hostname that resolves to an internal address, such as an AWS Instance Metadata Service endpoint, and submits it through the content pipeline. When Hugo rebuilds the site, the fetch succeeds and the response body is written to the published static output. The build artifact carries the exfiltrated data to any public host that serves the site.

For implementation-level detail, refer to the VulnCheck Advisory on SSRF and the Hugo Security Configuration Code.

Detection Methods for CVE-2026-10582

Indicators of Compromise

Outbound HTTP requests from Hugo build hosts to RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254
Unexpected content blocks in published static output containing tokens, JSON metadata, or internal hostnames
DNS resolutions during Hugo builds where an externally registered hostname maps to a private or link-local address
Build logs referencing resources.GetRemote calls to hostnames that were introduced through content or CMS updates

Detection Strategies

Instrument the build environment to log every DNS resolution and TCP destination initiated by the Hugo process
Compare hostnames referenced in content commits against a known-good allowlist maintained outside the repository
Scan generated output for patterns matching cloud metadata responses, session tokens, or internal service banners before publishing

Monitoring Recommendations

Forward build-host network telemetry and DNS logs to a centralized analytics platform for correlation across builds
Alert on any Hugo build process establishing connections to link-local, loopback, or private address ranges
Track changes to security.http.urls configuration values in version control and require review for allowlist modifications

How to Mitigate CVE-2026-10582

Immediate Actions Required

Audit all Hugo templates for use of resources.GetRemote and identify every URL source that accepts external input
Restrict security.http.urls to a minimal set of fully qualified, vendor-controlled hostnames rather than broad patterns
Execute Hugo builds inside a network-isolated environment that blocks egress to loopback, private, and metadata addresses at the firewall layer

Patch Information

Monitor the GitHub Hugo Repository for a fixed release that adds destination address validation. A complete fix requires a dial-time control that resolves the hostname, inspects the resulting IP, and rejects connections to loopback, private, link-local, and cloud metadata ranges before the TCP handshake.

Workarounds

Enforce egress filtering on build hosts so that only approved public destinations are reachable, regardless of DNS resolution
Deploy an outbound HTTP proxy that validates resolved IPs and blocks requests to metadata services and internal networks
Sanitize content pipelines to strip or validate front-matter and CMS fields that could reach resources.GetRemote
Disable IMDSv1 on cloud instances and require IMDSv2 session tokens to reduce metadata exposure if SSRF succeeds

bash

# Example Hugo config restricting outbound URLs to explicit hostnames
# hugo.toml
[security.http]
  urls = ['^https://cdn\.example\.com/', '^https://assets\.example\.com/']
  methods = ['(?i)GET']