CVE-2026-91079 in hcengineering
Summary
by MITRE • 09/14/2026
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The Huly Platform version 0.7.426 contains a critical server-side request forgery vulnerability within its print service component. This flaw stems from the absence of hostname allowlist validation when processing user-supplied URLs for rendering purposes. The application utilizes Puppeteer, a headless browser automation tool, to fetch and render web content provided by users into downloadable PDFs or image formats. Because the system does not restrict which hostnames can be accessed during this process, authenticated workspace members are able to inject arbitrary external or internal Uniform Resource Locators as input parameters for the print endpoint. This lack of validation allows attackers to direct the server-side browser instance toward targets that were intended to remain inaccessible from public-facing interfaces.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and network reconnaissance within private infrastructure environments. By supplying URLs pointing to internal metadata services, such as cloud provider instance metadata endpoints or local API gateways, an authenticated attacker can force the Huly server to retrieve sensitive configuration data, authentication tokens, or other proprietary information stored on these internal hosts. Furthermore, this capability extends beyond simple data theft; it enables network scanning and mapping of internal assets that are not directly exposed to the internet. The ability to render arbitrary URLs also opens avenues for further exploitation if those internal services contain additional vulnerabilities that can be triggered via HTTP requests generated by the Puppeteer instance.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-918, which addresses Server-Side Request Forgery (SSRF). The specific mechanism involves improper restriction of allowed URLs or hosts, falling under CWE-425 as well. In terms of offensive security tactics, this behavior corresponds to the ATT&CK technique T1071, Application Layer Protocol, specifically within the context of web protocols used for data exfiltration and internal network discovery. The vulnerability highlights a common misconfiguration in applications that process user-controlled URLs without implementing strict validation rules or using safe URL parsing libraries that prevent protocol switching or IP address resolution to private ranges.
To mitigate this risk, immediate remediation should focus on implementing robust input validation at the print service level. Developers must enforce a strict hostname allowlist that permits only known and trusted domains required for legitimate printing functionality. Additionally, it is advisable to block requests targeting private IP address ranges, such as those defined in RFC 1918, including loopback addresses like 127.0.0.1 and link-local addresses. Implementing network-level controls, such as firewall rules or proxy configurations that prevent the application server from initiating outbound connections to internal subnets, provides a defense-in-depth layer against SSRF attacks. Regular security audits of URL handling logic in all user-facing endpoints are essential to ensure that similar vulnerabilities do not exist elsewhere in the platform architecture.