6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50134

CVE-2026-50134: Hugo: security.http.urls allow-list bypass via HTTP redirects

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50134

CVE-2026-50134:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gohugoio/hugo	go	>= 0.91.0, < 0.162.0	0.162.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in Hugo's resources.GetRemote function. The root cause is that the underlying HTTP client would follow HTTP 3xx redirects without re-validating the redirected URL against the configured security.http.urls allow-list.

The patch is in the create.New function in resources/resource_factories/create/create.go. This function is responsible for creating the http.Client used for fetching remote resources. The fix involves adding a CheckRedirect function to the http.Client's configuration. This new function ensures that every redirected URL is checked against the allow-list.

The vulnerable function is identified as create.New because it is responsible for creating the misconfigured http.Client that lacks the redirect validation. While resources.GetRemote is the user-facing function that triggers the vulnerability, create.New is where the vulnerable component is instantiated. During exploitation, a call to resources.GetRemote would lead to the use of this vulnerable client, allowing the SSRF.

Vulnerable functions

create.New

resources/resource_factories/create/create.go

The `create.New` function is responsible for creating an `http.Client` for fetching remote resources. Prior to the patch, this `http.Client` was created without a `CheckRedirect` function, causing it to blindly follow HTTP redirects. This allows a malicious server to redirect the client to a URL that is not in the `security.http.urls` allow-list, leading to a Server-Side Request Forgery (SSRF) vulnerability. The function `resources.GetRemote` uses the client created by `create.New` and is the entry point for the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.