CVE-2026-100693 in Hugo
Summary
by MITRE • 09/26/2026
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like localhost.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
Hugo, a widely used static site generator written in Go, contains a critical validation flaw within its security configuration mechanism affecting versions between v0.162.0 and v0.165.x prior to the release of v0.166.0. The vulnerability specifically targets the handling of IP-literal deny rules defined in the security.http.urls configuration block. This component is designed to prevent server-side request forgery by restricting which remote resources can be fetched during site generation, particularly protecting against SSRF attacks that target internal services or localhost interfaces.
The core technical flaw lies in a case-sensitive validation error within the IP-literal parsing logic. When Hugo processes URLs for fetching external content via functions such as resources.GetRemote, it checks the destination address against configured deny lists to ensure compliance with security policies. However, the implementation fails to normalize the hostname or IP literal before performing this comparison. This oversight allows attackers to bypass restrictions by utilizing mixed-case URL schemes or hostnames that do not strictly match the case of the denied entries in the configuration file. For instance, if a rule denies access to localhost, an attacker might exploit variations in how Go's net package resolves certain hostname formats combined with specific casing tricks to evade detection.
This vulnerability enables unauthorized data exfiltration and server-side request forgery attacks against internal network services that are typically considered safe from external exposure during the build process. By bypassing these restrictions, a malicious actor can force Hugo to make HTTP requests to restricted IP addresses such as 127.0.0.1 or localhost on ports where sensitive administrative interfaces, databases, or metadata services might be running. This could lead to the disclosure of internal network topology, authentication tokens stored in local configuration files, or other sensitive data accessible only via loopback interfaces.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method for SSRF attacks under MITRE ATT&CK technique T1583. The failure to normalize input before security checks is a classic example of improper validation that leads to access control bypasses. It highlights the importance of case-insensitive comparison or strict normalization when dealing with network identifiers in security-critical applications.
To mitigate this vulnerability, users must upgrade Hugo to version v0.166.0 or later where the IP-literal deny rule logic has been corrected to handle casing variations appropriately. Until an upgrade is possible, administrators should ensure that their Hugo configurations do not rely solely on case-sensitive string matching for critical security boundaries and consider implementing additional network-level controls such as firewall rules to restrict outbound connections from build environments to internal services. Regular auditing of static site generator configurations against known vulnerability databases is also recommended to maintain a secure development pipeline.