CVE-2026-10582
CVE-2026-10582: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.4
High [CVE-2026-10582] Server-Side Request Forgery (SSRF) leading to information disclosure.
CVE-2026-10582Source published Source updated
Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources. GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a…
- Affected products in this advisory
- Red Hat Hardened Images
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- hugo-main-0.166.0-0.1.hum1
- RHSA-2026:66266
- Mitigation guidance
- To mitigate this vulnerability, ensure that the Hugo `security.http.urls` allowlist is strictly configured to permit outbound requests only to explicitly trusted external domains. Implement network egress filtering to prevent Hugo from initiating connections to internal, loopback, or private IP address ranges. This can be achieved by configuring firewall rules or network policies to block outbound traffic from the Hugo environment to RFC1918 addresses and other internal network segments.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.