CVE-2026-50134: Hugo Security Policy Bypass via HTTP Redirect

Technical summary

The vulnerability exists in Hugo's resources.GetRemote function, which validates URLs against the security.http.urls policy only at initial invocation, not on subsequent HTTP 3xx redirects. An attacker controlling a whitelisted endpoint can respond with a redirect (301, 302, 307, etc.) pointing to a blacklisted host. Because Hugo follows redirects without re-validating against the security policy, it fetches content from the forbidden target. This also bypasses any host-shape restrictions (regex or CIDR-based patterns) the operator configured. The issue is classified as CWE-918 (Server-Side Request Forgery), reflecting the ability to make Hugo issue requests to unintended destinations.

Business impact

Organizations using Hugo with configured URL access control policies may have those policies silently bypassed. If Hugo sites are used in build pipelines or CI/CD workflows that fetch remote configuration, templates, or data, attackers could inject malicious content or exfiltrate sensitive information from restricted internal networks. The impact is most acute in environments where Hugo runs with access to private networks or where site content influences downstream systems. Since this is a static site generator, the risk is primarily at build time rather than runtime, but compromised site content can have downstream effects on published materials and user trust.

Affected systems

Hugo versions 0.91.0 through 0.161.x are vulnerable. Version 0.162.0 and later contain the fix. Any Hugo installation using resources.GetRemote with security.http.urls policies configured is at risk, particularly in automated build environments. Organizations should verify their installed Hugo version and check if they rely on URL access controls.

Exploitability

Exploitability is moderate to high in specific contexts. An attacker must either control a whitelisted server or compromise its DNS/network layer. No user interaction or authentication is required once that control is established. For public-facing Hugo sites that fetch from third-party CDNs or services, this could be exploited by compromising those services. For internal builds, the attacker surface is narrower but still present in multi-tenant CI/CD environments or if a dependency is compromised. The vulnerability does not require Hugo to be misconfigured—a correctly configured policy is bypassed.

Remediation

Upgrade Hugo to version 0.162.0 or later. This version re-validates URLs at each redirect hop against the configured security policy. Organizations should prioritize this upgrade for any Hugo instances in security-sensitive build pipelines. Additionally, apply defense-in-depth practices: use network segmentation to limit where build systems can connect, sign and verify fetched content where possible, and audit Hugo's configuration to confirm security.http.urls policies match intended access controls.

Patch guidance

Upgrade to Hugo 0.162.0 or later. Consult the official Hugo releases page and your package manager (homebrew, apt, etc.) for the latest version. If you are on a version prior to 0.91.0, you are not affected. If you are between 0.91.0 and 0.161.x, update immediately. Test the upgrade in a staging environment to confirm no template or configuration changes are needed, then roll out to production and development build systems. Verify the new version is in use by running `hugo version`.

Detection guidance

Examine your Hugo configuration files (config.toml, config.yaml) for any security.http.urls policy definitions. If none exist, this vulnerability does not apply to your setup. If policies are configured, audit your site's templates and content files for calls to resources.GetRemote, particularly those fetching from external sources. Review your build logs and network traffic for unexpected outbound connections or redirects. Consider deploying network-level detection to identify HTTP 3xx responses from allowed hosts followed by connections to blocked hosts. After upgrading to 0.162.0, re-validate that your policies are now being enforced correctly.

Why prioritize this

This vulnerability should be prioritized for teams using Hugo in security-sensitive contexts. Although the CVSS score is medium (5.8), the practical impact depends heavily on your threat model and build infrastructure. If Hugo runs in an air-gapped or restricted network environment, or if your security policies exist to protect access to internal services, this is a critical fix. If Hugo is used only for public-facing sites with no sensitive remote fetching, the risk is lower. The fact that it silently bypasses your intended controls—rather than failing safely—makes it particularly dangerous.

Risk score, explained

The CVSS 3.1 score of 5.8 (Medium) reflects a network-accessible vulnerability with low attack complexity and no user interaction required, but limited scope and impact (low confidentiality, no integrity or availability impact under the CVSS model). However, CVSS does not fully capture context-dependent risk: in a build pipeline with access to internal networks or sensitive data sources, the actual impact could be higher. Conversely, for low-risk deployments, the practical risk is lower. Use this score as a floor for risk prioritization, and apply your own contextual assessment.

Frequently asked questions