CVE-2026-58404: Hugo SSRF Bypass via Alternative IP Encodings

Technical summary

Hugo's default security.http.urls policy enforces server-side request forgery (SSRF) protections by denying HTTP requests to loopback addresses (127.0.0.0/8), internal RFC1918 ranges, and cloud-metadata endpoints. However, the deny rule performs a string-based match only against dotted-decimal IPv4 notation (e.g., 127.0.0.1). Alternate representations—integer format (2130706433), hexadecimal (0x7f000001), and octal (0177.0.0.1)—bypass the filter. When resources.GetRemote processes a template URL with an alternative-encoded IP literal and the host resolver uses cgo (typical on most Unix systems), the OS resolver translates the non-standard encoding to the canonical address, which then connects to the blocked service. The same validation gap affects HTTP redirect chains, permitting attackers to bypass the policy on each hop. This affects Hugo builds where untrusted or data-derived content flows into template functions that perform remote fetches.

Business impact

In hosted and CI/CD environments, this vulnerability permits unauthorized access to cloud-metadata services during static site builds. An attacker who can inject malicious template content—through frontmatter processing, data files, or dynamic template generation—can exfiltrate credentials, API tokens, or role metadata. In corporate deployments, this compounds the risk if Hugo builds run with elevated cloud IAM permissions. For open-source projects accepting community templates or using third-party themes without strict sandboxing, the attack surface expands. The confidentiality impact is rated high because metadata endpoints often leak sensitive operational secrets; however, direct system compromise or data manipulation is not feasible through this vector alone.

Affected systems

Hugo versions 0.162.0 through 0.163.0 are affected. Any deployment that (1) processes user-supplied or untrusted template content, (2) runs in an environment with accessible loopback or cloud-metadata services (AWS IMDSv2, Google Compute Engine metadata, Azure IMDS), and (3) relies on the cgo system resolver is at risk. Self-hosted environments with strict network isolation and containerized builds without metadata endpoint access face lower risk. Upgrade to version 0.163.1 or later to remediate.

Exploitability

Exploitation requires the ability to inject or modify template content within a Hugo build context. This is most practical in scenarios where Hugo processes untrusted frontmatter, data files from external sources, or dynamically generated templates. The attacker must craft a URL using an alternative IP encoding (e.g., resources.GetRemote("http://2130706433/")). No special privileges or user interaction are required at runtime; the attack occurs during the build phase. The CVSS vector indicates authentication is required (PR:L), reflecting the assumption that template modification requires at least contributor-level access. However, in open-source projects or workflows accepting pull requests, this barrier may be low. The attack is reliable and not probabilistic.

Remediation

Upgrade Hugo to version 0.163.1 or later immediately. This release fixes the security.http.urls policy to recognize and reject alternate IPv4 encodings. For organizations unable to patch immediately, implement compensating controls: (1) restrict Hugo build environments to networks without access to metadata endpoints, (2) disable or revoke cloud IAM credentials from build runners, (3) enforce code review workflows to prevent malicious template injection, and (4) consider using Hugo's sandboxing features if available or running builds in isolated containers. Do not rely solely on WAF or firewall rules, as the attack occurs at build time, not runtime.

Patch guidance

Apply Hugo version 0.163.1 or later. Verify the update by running `hugo version` and confirming the patch version. Review your theme and plugin dependencies to ensure they are also compatible with 0.163.1. If using a package manager (Homebrew, apt, etc.), update through the standard channel. For Docker-based workflows, rebuild images with the patched Hugo binary. No configuration changes or theme modifications are required post-patch. Existing projects should redeploy their site with the patched version to clear any cached artifacts.

Detection guidance

Monitor Hugo build logs for unexpected outbound requests to loopback addresses (127.x.x.x, ::1), private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud-metadata endpoints (169.254.169.254, metadata.google.internal, etc.). Set network egress policies to alert on such requests from CI/CD runners. Audit frontmatter and data file sources to identify any suspicious template injection. Implement strict Content Security Policy rules in resulting static sites to limit downstream exploitation. Correlate Hugo build execution times with unexpected network activity. For teams using threat intelligence integrations, watch for templates or themes that reference IP encodings in resources.GetRemote calls.

Why prioritize this

This vulnerability should be prioritized for any Hugo deployment in cloud environments or CI/CD pipelines. The CVSS score of 6.8 (Medium) reflects high confidentiality risk with limited user interaction and authentication barriers in open-source contexts. The attack is practical and does not require exploit code—only a malicious template—making it actionable for adversaries with template-modification access. Cloud-native setups are at heightened risk because metadata endpoints leak high-value secrets. The lack of current KEV status does not diminish the threat; active exploitation in the wild is plausible given the simplicity of the bypass.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects: (1) Network-accessible attack vector (AV:N) because Hugo builds may run in cloud or hosted environments, (2) Low attack complexity (AC:L) because crafting an alternative IP encoding is trivial, (3) Low privileges required (PR:L) in open-source or pull-request workflows where contributors can modify templates, (4) User interaction required (UI:R) because a maintainer must execute the build with the malicious template, (5) Changed scope (S:C) because the attack crosses from the build system into cloud infrastructure, (6) High confidentiality impact (C:H) due to metadata exfiltration, and (7) no integrity or availability impact (I:N, A:N). The score appropriately reflects a serious confidentiality risk without direct system compromise.

Frequently asked questions