CVE-2026-91079

Executive Summary

Huly Platform (a collaboration/project management suite) through version 0.7.426 contains a server-side request forgery (SSRF) vulnerability (CWE-918) in its print service, caused by missing hostname allowlist validation. Any authenticated workspace member can supply an arbitrary URL to the print endpoint; the server-side headless browser (Puppeteer) fetches and renders that URL, returning the result as a downloadable PDF or image. Because the rendering occurs server-side with no egress restrictions, an attacker can pivot to internal metadata services (e.g., cloud instance metadata endpoints) and internal network hosts that are otherwise unreachable from the internet, resulting in high-confidentiality exposure with a CVSS score of 8.5.

Technical Analysis

The vulnerability class is server-side request forgery (SSRF), mapped to CWE-918. The specific attack surface is the print service component of the Huly Platform. The print service accepts a URL supplied by the caller, then asks Puppeteer (a headless Chromium automation library) to render that URL and return the rendered output as a downloadable PDF or image.

The root cause is stated plainly in the NVD description: missing hostname allowlist validation. In a correctly implemented SSRF-resistant print/render service, the application should validate the user-supplied URL against a strict allowlist of permitted hostnames (or resolve the host and reject private/link-local/loopback ranges). Huly Platform through 0.7.426 does not perform this validation, so the URL accepted from the workspace member is passed to the rendering backend with no restriction on destination.

Two properties amplify the issue:

1. Server-side rendering context. Puppeteer executes inside the Huly server environment, not the client. Requests emitted by the renderer originate from the server's network position, so the attacker inherits the server's reachability — internal network segments, private address space, and cloud metadata services become accessible.
2. Response exfiltration channel. Unlike a blind SSRF where the attacker cannot see the fetched content, the print service returns the rendered result to the requester as a downloadable PDF or image. This converts the SSRF into a full-response vulnerability: the fetched internal content is rendered and handed back to the attacker.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N reflects this: network exploitable, low complexity, low privileges required (an authenticated workspace member), no user interaction, scope changed (the vulnerable component and the impacted component are different — the server acts on behalf of the attacker against third-party internal systems), high confidentiality impact (internal data returned), low integrity impact, and no availability impact.

Several details are not specified in the available data and are explicitly not asserted here: the exact endpoint path, the parameter name carrying the URL, the precise rendering flow, and whether redirects are followed. These are not fabricated below.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the attack chain below is inferred from the vulnerability class (CWE-918 SSRF via a server-side rendering service) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a reachable, internet-exposed (or VPN-reachable) Huly Platform instance running a version ≤ 0.7.426. Version detection is possible where the platform exposes version-identifying responses. The attacker obtains a valid account with membership in any workspace — for example, via a legitimate invitation, a self-service workspace, or standard low-privilege credentials. No elevated role is required per the CVSS privilege vector (PR:L).

2. Triggering the flaw class. The attacker invokes the print service and supplies an arbitrary URL in the field the service accepts. Because the service performs no hostname allowlist validation, the server accepts attacker-controlled destinations. There is no hostname allowlist to bypass and no filtering step to circumvent — the missing control is the flaw. The document/print request is issued while authenticated as a workspace member.

3. Payload / execution method (vulnerability-class level). The attacker points the supplied URL at an internal-only target. Typical classes of target for SSRF against a server-side renderer include:

   • Cloud instance metadata services — the classic high-value SSRF target, reachable from the server's network position in most cloud deployments and capable of returning sensitive instance/credential material.
   • Internal network hosts and services — private-address-space web services, admin panels, and line-of-business applications not reachable from the attacker's own network position. Because the print service renders the fetched URL and returns a PDF or image, the attacker receives the rendered internal content directly rather than inferring it blind. (Specific metadata paths, header requirements, and endpoint URLs are intentionally not enumerated here, as they are not stated in the source data.)

4. Post-exploitation impact. The rendered internal responses disclose sensitive data (consistent with C:H). In the case of cloud metadata services, disclosed content may include credentials or tokens usable to pivot further into the cloud account. Enumerated internal hosts expand the attacker's network map of the target organization. The low integrity component (I:L) reflects potential limited effect on the target's own data via the served output.

The distinguishing characteristic versus generic SSRF: the attacker does not need to guess — the PDF/image response is the exfiltration channel.

Impact Assessment

• Confidentiality (C:H): The primary and severe consequence. Internal metadata services and internal network hosts — normally isolated from external access — have their responses rendered and returned to the attacker. This can leak cloud credentials, tokens, internal API data, configuration, and internal application content.
• Scope (S:C): The security authority of the vulnerable Huly component is exceeded: it is weaponized to issue requests against systems outside its own trust boundary.
• Privileges (PR:L): Any authenticated workspace member qualifies. This significantly widens the set of possible attackers — a single compromised low-privilege collaborator account (or a self-registered workspace user) is sufficient.
• Integrity (I:L) / Availability (A:N): Limited integrity effect via returned content; no direct availability impact is described.
• Blast radius: Every internet- or VPN-facing Huly Platform instance ≤ 0.7.426 with the print service enabled and reachable by authenticated members. Because the pivot is into the server's network position, blast radius is defined by network reachability from that host — which commonly includes cloud metadata and internal segmentation the perimeter was meant to protect. Small-to-large collaboration deployments are equally exposed, but larger, segmented enterprise networks present a richer internal target set.
• Business impact: Potential cloud credential compromise, internal reconnaissance, and disclosure of confidential internal resources. Detection difficulty is low in principle (the print endpoint is a logical chokepoint) but requires targeted monitoring, as detailed below.

Detection Guidance

Sigma Rule

title: Potential Huly Platform Print Service SSRF (CWE-918)
id: 8b7c1e42-3a9d-4f6e-9c2a-hulyprintssrf
status: experimental
description: Detects requests to the Huly Platform print service carrying a URL pointing to
  internal/private/link-local targets, consistent with SSRF (CVE-2026-91079).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91079
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: huly
detection:
  selection_svc:
    cs-uri-stem|contains: 'print'
  selection_internal:
    cs-uri-query|re: '(?i)(127\.0\.0\.1|localhost|0\.0\.0\.0|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|169\.254\.169\.254|metadata\.|\.internal|\.local)'
  condition: selection_svc and selection_internal
falsepositives:
  - Legitimate print/render requests to internal documentation hosts, if any
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_91079_Huly_Print_SSRF
{
    meta:
        description = "Detects HTTP request patterns targeting the Huly print service with internal-target URLs (CVE-2026-91079, CWE-918 SSRF)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91079"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "print" ascii nocase
        $meta1 = "169.254.169.254" ascii
        $meta2 = "metadata.google.internal" ascii nocase
        $meta3 = "metadata/" ascii nocase
        $priv1 = "127.0.0.1" ascii
        $priv2 = "localhost" ascii nocase
        $priv3 = "10.0." ascii
        $priv4 = "192.168." ascii

    condition:
        $a and any of ($meta*) or ($a and 2 of ($priv*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91079 Huly Platform Print Service SSRF Attempt (internal target)"; flow:established,to_server; http.uri; content:"print"; nocase; http.uri; pcre:"/(127\.0\.0\.1|localhost|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|169\.254\.169\.254|metadata)/i"; reference:cve,2026-91079; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91079; classtype:web-application-attack; sid:9001079; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [network where process.name : ("node" or "chromium" or "chrome") and destination.ip in ("127.0.0.1","169.254.169.254") and network.direction == "egress"]
  [file where event.action == "creation" and file.extension in ("pdf","png","jpg")]

Splunk SPL Query

index=web_logs (uri_path="*print*" OR uri="*print*")
| rex field=uri "(?<target_url>(?i)(https?://|//)[^\s&]+)"
| where match(target_url, "(?i)(127\.0\.0\.1|localhost|0\.0\.0\.0|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|169\.254\.169\.254|metadata\.|\.internal)")
| stats count values(target_url) as internal_targets by src_ip, user, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,huly,ssrf,">
  <rule id="100910" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.</field>
    <regex>(?i)(127\.0\.0\.1|localhost|10\.\d+\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|192\.168\.\d+\.\d+|169\.254\.169\.254|metadata\.)</regex>
    <description>CVE-2026-91079: Huly print service SSRF attempt against internal/metadata target</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_91079,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims a patch exists; this has not been independently confirmed. The affected range is listed as "through 0.7.426", indicating an upgrade is the presumed remedy, but a specific fixed version is not confirmed in the available data.

1. Immediate mitigations (no patch dependency):

   • Restrict inbound access to the Huly print service so only trusted networks/users can reach it; if printing is not required, disable the print service.
   • Apply egress network controls on the Huly server: block access from the Huly host to cloud instance metadata endpoints (e.g., via IMDSv2 enforcement where applicable) and to private/link-local/loopback ranges except where required.
   • Reduce the exposure window: audit workspace membership and remove unnecessary authenticated members, since PR:L means any workspace member can exploit this.
   • Enforce authentication review: ensure only users who genuinely need the platform retain accounts.

2. Patch / upgrade:

   • Upgrade Huly Platform to a version above 0.7.426. Confirm the specific fixed version against the vendor/OSV advisory before scheduling maintenance, since the patch is CLAIMED by a single source and not independently verified.
   • Verify the fix introduces hostname allowlist validation in the print service before considering the deployment remediated.

3. Long-term hardening:

   • Implement and enforce a strict URL allowlist (and/or DNS-resolution-based blocking of private ranges) for any server-side fetch/render feature — treat every user-supplied URL passed to a headless browser as untrusted.
   • Deploy SSRF-resistant egress architecture: run render/print workloads in an isolated network segment with deny-by-default egress to internal and metadata endpoints.
   • Adopt structured input validation and centralized SSRF controls at the application framework level so similar features do not regress.
   • Continuous monitoring: enable the detection rules above to catch attempts targeting the print service, and alert on server-side renderer processes making requests to private/link-local addresses.

References

• NVD — CVE-2026-91079: https://nvd.nist.gov/vuln/detail/CVE-2026-91079
• CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• OSV advisory entry (patch source, CLAIMED): https://osv.dev/ (package entry corresponding to Huly Platform; single-source patch claim)
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OWASP — Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

No public PoC, exploit code, or Nuclei template was identified. CVE-2026-91079 is not listed in CISA KEV, and there is no available evidence of exploit-in-the-wild activity or named threat-actor campaigns at the time of writing.