CVE-2026-91079: Huly Platform SSRF Vulnerability

CVE-2026-91079 Overview

CVE-2026-91079 is a server-side request forgery (SSRF) vulnerability [CWE-918] affecting Huly Platform through version 0.7.426. The print service fails to validate hostnames against an allowlist before rendering supplied URLs. Authenticated workspace members can pass arbitrary URLs to the print endpoint, which the service loads through Puppeteer and returns as downloadable PDFs or images. This behavior allows attackers to reach internal metadata endpoints, private network hosts, and other resources normally isolated from external clients.

Critical Impact
Authenticated users can coerce the Huly print service into fetching internal URLs, exposing cloud metadata services and internal network resources through rendered PDF or image output.

Affected Products

Huly Platform versions through 0.7.426
Huly pod-print print service component
Deployments relying on the default services/print/pod-print configuration

Discovery Timeline

2026-09-14 - CVE-2026-91079 published to the National Vulnerability Database
2026-09-14 - Last updated in the NVD database

Technical Details for CVE-2026-91079

Vulnerability Analysis

The Huly print service exposes an endpoint that accepts a target URL and returns a rendered PDF or image produced by Puppeteer. The endpoint does not enforce a hostname allowlist or block requests to private address ranges. Any authenticated workspace member can submit URLs pointing to internal services, and the headless browser will fetch and render them server-side. The returned document contains the response body, which effectively acts as a read primitive for internal HTTP resources.

Because Puppeteer executes a full browser context, attackers can request cloud instance metadata endpoints, internal admin panels, and unauthenticated management interfaces reachable from the print pod. The rendered output is then delivered back to the requester as a normal file download.

Root Cause

The root cause is missing input validation on the destination URL in the print service. The configuration in services/print/pod-print/src/config.ts and request handling in services/print/pod-print/src/server.ts do not implement hostname allowlisting, DNS resolution checks, or blocking of loopback and link-local ranges. Any URL supplied by an authenticated caller is passed directly to Puppeteer.

Attack Vector

An authenticated workspace member sends a request to the print endpoint with a URL targeting an internal resource, such as a cloud metadata service on 169.254.169.254, an internal admin console, or a private API. Puppeteer navigates to that URL from the print pod, renders the response, and returns a PDF or image containing the response content. The attacker downloads the file and extracts sensitive information such as cloud credentials, service tokens, or internal application data.

See the VulnCheck SSRF Advisory and GitHub Issue #10908 for additional technical detail.

Detection Methods for CVE-2026-91079

Indicators of Compromise

Print service requests targeting internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, or 169.254.0.0/16
Outbound HTTP requests from the pod-print container to cloud metadata endpoints, including 169.254.169.254 on AWS and Azure or metadata.google.internal on GCP
Unusual volume of PDF or image generation requests originating from a single workspace user

Detection Strategies

Inspect print service access logs for URL parameters resolving to private, loopback, or link-local addresses
Correlate authenticated workspace user activity with unexpected outbound connections from the print pod
Alert on egress traffic from the print service to hosts outside the documented set of allowed rendering targets

Monitoring Recommendations

Forward pod-print application and network logs to a centralized analytics platform for retention and query
Baseline normal destinations rendered by the print service and alert on deviations
Monitor cloud audit logs for metadata service access patterns originating from the Huly workload identity

How to Mitigate CVE-2026-91079

Immediate Actions Required

Restrict network egress from the pod-print container so it cannot reach cloud metadata endpoints or internal management interfaces
Require IMDSv2 with hop limit 1 on AWS deployments to block metadata retrieval through server-side proxies
Limit which workspace roles can invoke the print endpoint until a patched release is deployed

Patch Information

At the time of publication no fixed release is referenced in the advisory. Track the Huly Platform GitHub Repository and GitHub Issue #10908 for a patched version that adds hostname allowlist validation to the print service.

Workarounds

Place the print service behind an egress proxy that enforces a domain allowlist for outbound HTTP requests
Deploy the pod-print pod on a network segment with no route to internal services or cloud metadata addresses
Add a reverse-proxy filter in front of the print endpoint that rejects request bodies containing private, loopback, or link-local hostnames and IPs

bash

# Example Kubernetes NetworkPolicy restricting pod-print egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: pod-print-egress-restrict
spec:
  podSelector:
    matchLabels:
      app: pod-print
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
              - 169.254.0.0/16
              - 127.0.0.0/8