CVE-2026-10582: Server-Side Request Forgery (SSRF) in gohugoio hugo

Hugo's security.http.urls allowlist mechanism inspects only the URL text and a canonicalized form of the host but does not resolve hostnames or verify the IP address at connection time. The HTTP client used does not perform dial-time checks. This allows an attacker who can supply URLs in content (e.g., front-matter or CMS fields) to cause the build process to fetch internal or cloud metadata endpoints. The fetched response is embedded in the static site output, effectively exfiltrating internal data via the build artifact. This is a server-side request forgery vulnerability affecting Hugo versions 0.91.0 through 0.165.0.

An unauthenticated attacker who can supply URLs in content fields can cause the Hugo build process to make HTTP requests to internal or cloud metadata services that are normally inaccessible externally. The responses from these internal endpoints are embedded in the generated static site, potentially exposing sensitive internal information publicly. This can lead to information disclosure without requiring authentication or user interaction beyond supplying content with malicious URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid building sites with untrusted content that can supply URLs to the resources.GetRemote function or disable the use of external HTTP fetches in the build process if possible.