CVE-2026-91079— Huly Platform through 0.7.426 SSRF via Print Service
Quick assessment
Affected
hcengineering platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Huly 平台在 0.7.426 及更早版本中存在服务器端请求伪造（SSRF）漏洞，原因是打印服务缺少对主机名的白名单验证。经过身份验证的工作区成员可以向打印端点传入任意 URL，Puppeteer 会渲染这些 URL 并将其返回为可下载的 PDF 或图像，从而允许访问内部元数据服务和网络主机。
Possible ATT&CK Techniques 1 AI
T1016 · System Network Configuration DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| hcengineering | platform | ≤ 0.7.426 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91079
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Huly Platform through 0.7.426 SSRF via Print Service
Source: CVE Program / CVE List V5
Vulnerability Description
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| hcengineering | platform | 0 ~ 0.7.426 | - |
|
II. Public POCs for CVE-2026-91079
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91079
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-91079 (1)
Vendor Advisories for CVE-2026-91079 (1)
-
🔗 Huly Platform through 0.7.426 SSRF via Print Service | Advisories | VulnCheck third-party-advisory
Other References for CVE-2026-91079 (3)
IV. Related Vulnerabilities
Same product: platform
-
CVE-2026-81846
runZero MCP 'Findings summaries' Data Leak -
CVE-2026-56769
Huly Platform - Server-Side Request Forgery via /import Endp -
CVE-2026-7778
runZero Platform dashboard configuration exposure -
CVE-2026-5384
runZero Platform incorrect credential scope -
CVE-2026-5382
runZero Platform MCP endpoint information leak
Same vendor: hcengineering
-
CVE-2026-56769
Huly Platform - Server-Side Request Forgery via /import Endp -
CVE-2026-12213
hcengineering Huly Platform User Information operations.ts g -
CVE-2026-12212
hcengineering Huly Platform RPC operations.ts getMailboxSecr -
CVE-2026-5623
hcengineering Huly Platform Import Endpoint index.ts server- -
CVE-2026-5622
hcengineering Huly Platform JWT Token token.ts hard-coded ke
Same weakness: CWE-918
-
CVE-2026-73497
MCP Atlassian is a Model Context Protocol (MCP): DNS-rebindi -
CVE-2026-90814
cosmicstack-labs mercury-agent GitHub API github.ts githubRe -
CVE-2026-91081
Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpo -
CVE-2026-55073
WeasyPrint restrictive URL fetcher bypass allows local file -
CVE-2026-54452
safeurl: Missing IPv6 CIDR Ranges in Blocklist
V. Comments for CVE-2026-91079
No comments yet