A server-side request forgery (SSRF) vulnerability exists in Huginn versions from 2026.09.09 up to but not including 2026.11.09. The flaw arises because the egress proxy configuration applies only to certain HTTP clients (Faraday and Typhoeus), allowing authenticated users to exploit other HTTP clients (HTTParty, open-uri, Net::HTTP) to send requests directly to internal services. This can lead to exposure of internal data via the JiraAgent, which returns response data as events.