Huginn versions through 2022.08.18 have a server-side request forgery (SSRF) vulnerability in the fetch_url method of ScenarioImport. This flaw allows authenticated users to submit crafted URLs that trigger arbitrary HTTP requests from the server. Exploitation can enable attackers to probe internal network services, enumerate ports using error responses, and access cloud metadata endpoints to obtain sensitive credentials.