Huly Platform EUVD-2026-39521

Exploitation requires a valid authenticated workspace user account (CVSS PR:L); anonymous or unauthenticated requests cannot trigger the vulnerable endpoint. The /import endpoint of the Huly front pod must be network-accessible. No special configuration beyond default Huly Platform deployment is required once an account exists. Exploitation is most impactful when the front pod has network access to cloud metadata services (169.254.169.254 on AWS/GCP/Azure) or internal microservices, which is a common default in container-hosted environments. Limiting factors: requires workspace account creation or compromise; impact on the Huly application itself is minimal (VC:N) - harm is exclusively to internal systems reachable from the server's network position.

The CVSS 4.0 base score of 6.3 captures a nuanced risk profile: while the attack is network-reachable (AV:N), low-complexity (AC:L), and requires no user interaction (UI:N), it does demand a low-privilege authenticated session (PR:L), preventing unauthenticated mass exploitation. The scoring rightly assigns SC:H - the primary danger is not to the Huly application itself (VC:N, VA:N) but to subsequent internal systems reachable through its network position, such as cloud metadata endpoints (169.254.169.254), internal APIs, or microservice backends. VI:L and SI:L reflect the credential-replay risk. EPSS data was not provided; given a publicly available POC but no KEV listing, opportunistic exploitation by threat actors with insider knowledge or platform access is plausible. The absence of KEV suggests exploitation has not reached broad, indiscriminate levels at time of analysis. Real-world risk is elevated in cloud-hosted deployments where the front pod has network access to metadata services or sensitive internal endpoints.

An attacker with a valid Huly workspace account submits a POST request to the /import endpoint with a URL pointing to the EC2 instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The Huly front pod fetches the URL server-side and returns the response, exposing AWS IAM temporary credentials. The attacker then replays those credentials against AWS APIs to escalate privileges or access S3 buckets. A publicly available proof-of-concept exists in GitHub issue #10892 demonstrating this class of attack against the endpoint.