Hugo Allowlist Bypass via URL Canonicalization and DNS Resolution

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-10582 is a critical authorization bypass vulnerability in Hugo's static site generator affecting the security.http.urls allowlist control. The vulnerability exists in how Hugo validates outbound HTTP requests made by the resources.GetRemote function. While the allowlist applies pattern matching to URL text and attempts to canonicalize IPv4 addresses in different formats (integer, hex, octal), it fails to perform actual DNS resolution or inspect the final address the HTTP client connects to. This means attackers can bypass URL restrictions through DNS rebinding attacks, internationalized domain names (IDN), or by crafting URLs that canonicalize differently than expected. Organizations using Hugo with remote resource fetching—particularly in CI/CD pipelines or content management workflows—are at risk of server-side request forgery (SSRF) attacks that could expose internal services or enable data exfiltration.

Casky's 331 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Practitioners would see findings highlighting: (1) Reconnaissance patterns where attackers probe Hugo configurations for exposed allowlists or predictable URL patterns; (2) Defense Evasion techniques detecting obfuscated URLs using encoding, DNS tricks, or IPv4 format variations that slip past text-based validation; (3) Lateral Movement indicators when SSRF exploits access internal network resources; (4) Credential Access signals if attackers use SSRF to capture authentication tokens from internal services. The skills specifically flag gaps in hostname resolution validation and identify when HTTP client behavior diverges from URL allowlist intent—pinpointing the exact misalignment between what the allowlist permits and what actually gets fetched.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10582.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-10582

Casky has 331 skills that investigate the attack patterns behind CVE-2026-10582. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn