CVE-2026-58404: Gohugo Hugo SSRF Vulnerability

CVE-2026-58404 Overview

CVE-2026-58404 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Hugo, a widely used static site generator written in Go. The flaw affects versions v0.162.0 through v0.163.0. The default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation. Attackers can bypass the filter using alternate IPv4 encodings such as integer, hexadecimal, or octal representations. When a template passes an untrusted URL to resources.GetRemote and the host uses the cgo system resolver, these encodings resolve to blocked addresses. The issue is fixed in v0.163.1.

Critical Impact
Build-time SSRF against loopback, internal services, and cloud-metadata endpoints in hosted or CI environments, exposing credentials from providers like AWS IMDS.

Affected Products

Gohugo Hugo v0.162.0 through v0.163.0
Hugo deployments using resources.GetRemote with untrusted URLs
CI/CD pipelines and hosted build platforms running affected Hugo versions with the cgo system resolver

Discovery Timeline

2026-07-06 - CVE-2026-58404 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58404

Vulnerability Analysis

Hugo's resources.GetRemote function fetches external resources at build time. The security.http.urls policy is designed to block requests to sensitive internal targets, including loopback (127.0.0.0/8), RFC1918 private ranges, and cloud-metadata endpoints such as 169.254.169.254. The policy parses the URL host and checks if it matches deny-listed IPv4 literals in dotted-decimal form.

The deny check does not normalize alternative IPv4 host encodings before comparison. When a build template passes a URL sourced from untrusted data, an attacker can encode the same blocked address as an integer (2130706433), hexadecimal (0x7f000001), or octal (0177.0.0.1). The policy string-matches only dotted-decimal, so these encodings pass validation. When the request reaches Go's net package on platforms using the cgo system resolver, the OS resolves the encoded literal to the intended blocked IP. The same check is reused on redirect handling, so each redirect hop inherits the bypass.

Root Cause

The root cause is missing host normalization in Hugo's config/security/securityConfig.go URL policy enforcement. The deny rule matched textual patterns rather than resolving the host to its canonical IPv4 representation before comparison, leaving parsing behavior divergent between Hugo's filter and the OS resolver.

Attack Vector

An attacker who controls data consumed by a Hugo template, such as a content file, data file, or remote data source, injects a URL with an obfuscated host. During build, resources.GetRemote submits the request. On CI runners or hosted build services, this can reach the cloud provider's instance metadata service and exfiltrate temporary credentials through the built site output.

// Security patch: Normalize integer IPv4 host encodings
// in http.urls check
// File: config/security/securityConfig.go
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/netip"
+	"net/url"
 	"reflect"
 	"slices"
+	"strconv"
 	"strings"
 
 	"github.com/gohugoio/hugo/common/herrors"

Source: Hugo Security Commit a00b5c72

Detection Methods for CVE-2026-58404

Indicators of Compromise

Build logs showing outbound requests from resources.GetRemote to non-dotted-decimal hosts such as integer, hex, or octal IPv4 literals
Unexpected build-time HTTP calls targeting 169.254.169.254, 127.0.0.1, or RFC1918 addresses after decoding
Cloud audit events for instance metadata token requests originating from CI or build worker identities
Hugo build artifacts containing content sourced from internal service responses

Detection Strategies

Inspect Hugo project templates and data sources for calls to resources.GetRemote accepting untrusted or dynamically constructed URLs
Parse URL hosts in build logs and normalize non-dotted IPv4 encodings to identify bypass attempts
Monitor egress traffic from CI workers for connections to metadata IPs regardless of host encoding used at the application layer

Monitoring Recommendations

Enable cloud provider metadata service auditing, such as AWS IMDSv2 enforcement and access logging
Log all outbound HTTP requests initiated by the Hugo build process and alert on requests to loopback, RFC1918, or link-local ranges
Track deployed Hugo versions across build infrastructure and flag any instance running v0.162.0 through v0.163.0

How to Mitigate CVE-2026-58404

Immediate Actions Required

Upgrade Hugo to v0.163.1 or later across all build environments and developer workstations
Audit templates and data pipelines for use of resources.GetRemote with externally influenced URLs
Rotate any cloud credentials that may have been exposed through CI builds running affected Hugo versions
Enforce IMDSv2 with hop-limit restrictions on cloud instances hosting Hugo builds

Patch Information

The vulnerability is fixed in Hugo v0.163.1. The fix normalizes IPv4 host encodings before applying the security.http.urls deny rule. Full technical detail is available in the Hugo Security Advisory GHSA-r46f-3rpw-hxrv, the Hugo Pull Request #15020, and the Hugo v0.163.1 Release Notes.

Workarounds

Restrict Hugo's security.http.urls policy to an explicit allowlist of known-good hostnames instead of relying on default deny rules
Run Hugo builds in network-isolated environments with egress firewalls blocking loopback, RFC1918, and link-local addresses at the network layer
Disable or sandbox resources.GetRemote usage when processing untrusted content

bash

# Upgrade Hugo to the patched release
go install github.com/gohugoio/hugo@v0.163.1

# Verify installed version
hugo version

# Example strict allowlist in config.toml
# [security.http]
#   urls = ['^https://trusted\.example\.com/']