Is there a patch available for CVE-2026-58404?

Yes, a patch is available for CVE-2026-58404. Update the affected software to the latest version immediately.

Hugo CVE-2026-58404

Q: What is the CVSS score of CVE-2026-58404?

CVE-2026-58404 has a CVSS 4.0 base score of 4.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41918 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-06 GitHub_M

SSRF Red Hat Suse Hugo Gohugoio

4.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

AC:H reflects dual prerequisites (cgo resolver and attacker-influenced URL); PR:L for contributor-level access; S:C and C:H for cloud-metadata credential exposure across system boundary.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 20:04 vuln.today

DescriptionCVE.org

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.

AnalysisAI

Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the security.http.urls IP-block policy by supplying loopback or cloud-metadata addresses in alternate IPv4 encodings - integer, hex, or octal - that the deny rule does not recognize but the cgo system resolver silently normalizes and resolves. Templates invoking resources.GetRemote with attacker-influenced or data-derived URLs can reach internal services and cloud-metadata endpoints (e.g., AWS IMDSv1) at build time, a particularly acute risk in CI pipelines and hosted build services where instance credentials are accessible. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the fix is available in v0.163.1.

Technical ContextAI

Hugo is a Go-based static site generator; during builds it can fetch remote resources via the built-in resources.GetRemote function. To prevent SSRF, Hugo's security.http.urls configuration key maintains a deny list that blocks requests to loopback (127.0.0.0/8), RFC-1918 internals, and cloud-metadata addresses (169.254.169.254). The flaw, classified as CWE-918 (Server-Side Request Forgery), is that the deny-rule implementation only pattern-matched against canonical dotted-decimal IPv4 notation. Alternate representations of the same addresses - decimal integer (e.g., 2130706433 for 127.0.0.1), hexadecimal (0x7f000001), and octal (0177.0.0.1) - are not matched by the rule and therefore bypass the policy. Because the cgo-linked system resolver normalizes these encodings to their canonical form before making the TCP connection, the request still reaches the intended blocked address. The bypass also propagates to redirect handling, so each hop in an HTTP redirect chain is evaluated with the same incomplete check. The CPE for affected versions is cpe:2.3:a:gohugoio:hugo:*:*:*:*:*:*:*:* for v0.162.0 through v0.163.0.

RemediationAI

The primary fix is to upgrade to Hugo v0.163.1, which corrects the IPv4 encoding check to cover decimal-integer, hexadecimal, and octal representations. The patched release is available at https://github.com/gohugoio/hugo/releases/tag/v0.163.1; the underlying commit is https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372 and the fix PR is https://github.com/gohugoio/hugo/pull/15020. For teams unable to upgrade immediately, three compensating controls are available: first, audit all templates and data files to ensure resources.GetRemote is only called with fully hardcoded, trusted URL constants - this eliminates the attacker-influence prerequisite entirely; second, enforce network-level egress filtering in CI build environments to block outbound connections to 169.254.169.254 and RFC-1918 ranges at the firewall or container security-group level, noting that this does not protect loopback-targeted requests which remain on-host; third, build Hugo with CGO_ENABLED=0 to force the pure-Go resolver, which may handle alternate encodings differently - note this changes DNS resolution behavior globally and should be tested for side effects before deploying to production build pipelines.