CVE-2026-50134: Gohugo Hugo SSRF Vulnerability

CVE-2026-50134 Overview

CVE-2026-50134 is a Server-Side Request Forgery (SSRF) vulnerability in Hugo, the static site generator maintained by gohugoio. The flaw affects the resources.GetRemote function in versions from 0.91.0 up to (but not including) 0.162.0. Hugo validates the initial URL against the security.http.urls allowlist policy but fails to re-validate intermediate URLs when the server responds with an HTTP 3xx redirect. An allowed server, or an attacker controlling its DNS or HTTP responses, can redirect Hugo to a host explicitly forbidden by policy. The bypass also nullifies any host-shape restriction the operator configured. The issue is tracked as CWE-918: Server-Side Request Forgery and fixed in Hugo 0.162.0.

Critical Impact
An attacker controlling a permitted remote endpoint can pivot Hugo build-time fetches to internal or blocked hosts, defeating the security.http.urls allowlist.

Affected Products

Hugo versions 0.91.0 through 0.161.x (gohugoio/hugo)
Any CI/CD pipeline invoking resources.GetRemote with security.http.urls restrictions
Multi-tenant build environments relying on Hugo host allowlists as a boundary

Discovery Timeline

2026-07-06 - CVE-2026-50134 published to NVD
2026-07-08 - Last updated in NVD database
Fix commit - 86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50 merged into gohugoio/hugo
Advisory - GHSA-vxgm-5rmg-5w8g published

Technical Details for CVE-2026-50134

Vulnerability Analysis

Hugo's resources.GetRemote template function fetches external assets during site builds. Operators restrict which endpoints Hugo may contact through the security.http.urls configuration directive, typically a regular expression allowlist. The vulnerability arises because Hugo enforces this allowlist only against the initially-requested URL. When the remote server returns an HTTP 3xx status code with a Location header, Hugo follows the redirect without re-validating the new target against security.http.urls.

An attacker who controls DNS for an allowed hostname, or who can influence responses from an allowed server, can return 302 Found responses pointing at internal endpoints such as http://169.254.169.254/latest/meta-data/ (cloud instance metadata) or http://localhost:8080/admin. Hugo dutifully retrieves the redirected resource, embedding attacker-influenced content in the built site or exposing internal service responses during the build.

Root Cause

The redirect handler in resources/resource_factories/create/create.go did not invoke the URL-policy check on intermediate hops. The fix adds validation on every redirect target, ensuring each URL in the redirect chain satisfies security.http.urls before the HTTP client follows it.

Attack Vector

Exploitation requires no authentication and can be triggered whenever a Hugo build processes attacker-influenced content, such as a pull request adding a resources.GetRemote call, or an allowed upstream returning a crafted redirect. The attack complexity is low, but successful exploitation depends on the presence of a passive precondition — an allowlisted host that can be attacker-controlled or coerced.

 package create
 
 import (
+	"errors"
 	"net/http"
 	"os"
 	"path"
// Source: https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50
// The patch imports the errors package to support the new redirect-validation
// logic that re-checks each hop against security.http.urls before following.

Detection Methods for CVE-2026-50134

Indicators of Compromise

Hugo build logs showing resources.GetRemote fetches followed by unexpected content from internal RFC1918 or link-local ranges
HTTP 3xx responses in build-time proxy logs whose Location header points at hosts not present in security.http.urls
Outbound connections from build agents to 169.254.169.254, 127.0.0.1, or internal service ports during Hugo runs

Detection Strategies

Inspect the running Hugo binary version with hugo version and flag any release older than 0.162.0
Instrument the build environment with an egress proxy that logs full redirect chains for correlation against the allowlist
Review site source repositories for calls to resources.GetRemote that reference third-party or user-controllable URLs

Monitoring Recommendations

Alert on Hugo build agents initiating connections to cloud metadata endpoints or private IP ranges
Baseline expected outbound destinations for CI runners and flag deviations during static site generation
Track dependency updates so Hugo upgrades to 0.162.0 or later propagate across all build pipelines

How to Mitigate CVE-2026-50134

Immediate Actions Required

Upgrade Hugo to 0.162.0 or later across all developer workstations and CI/CD runners
Audit site configurations for security.http.urls entries and remove hosts that cannot be trusted to reject open-redirect abuse
Restrict build-agent network egress so metadata services and internal endpoints are unreachable regardless of application-layer controls

Patch Information

The fix is delivered in Hugo 0.162.0 via commit 86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50. See the GitHub Release v0.162.0 notes and the GHSA-vxgm-5rmg-5w8g advisory for full technical detail. After patching, each hop in a redirect chain is validated against security.http.urls.

Workarounds

Disable resources.GetRemote usage in templates until the Hugo binary is patched
Route Hugo traffic through a hardened forward proxy that enforces the same allowlist and blocks private address ranges
Use IMDSv2 or block instance-metadata access from build hosts to neutralize the highest-impact SSRF target

bash

# Verify installed Hugo version and enforce the fixed release
hugo version
# Expected: hugo v0.162.0 or later

# Example hardened security config in config.toml
[security]
  [security.http]
    urls = ['^https://cdn\.example\.com/']
    methods = ['(?i)GET']