CVE-2026-127083

MediumCVSS 6.4/10Last modified Nov 13, 2026

Description

Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1270847.3Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG o CVE-2026-1270854.3Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collec CVE-2026-1270866.3Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by s CVE-2026-1270873.1Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by sup CVE-2026-1270888.12FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging t CVE-2026-1270908.8Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication b CVE-2026-1270916.8Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path eq CVE-2026-1270926.1BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascrip CVE-2026-1270935.5Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send req CVE-2026-1270947.6Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.CVE-2026-1270995.9A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components in CVE-2026-12715.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio