CVE-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.

• CWE-918

• https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372Patch
• https://github.com/gohugoio/hugo/pull/15020Issue Tracking
• https://github.com/gohugoio/hugo/releases/tag/v0.163.1Release Notes
• https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrvMitigation, Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58389Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-5839A vulnerability was identified in PHPGurukul News Portal Pro…4.7
• CVE-2026-58399@acastellon/auth is an authentication control system for mic…8.7
• CVE-2026-5840A security flaw has been discovered in PHPGurukul News Porta…4.7
• CVE-2026-58402Hugo is a static site generator. From 0.60.0 until 0.163.3, …5.4
• CVE-2026-58403Hugo is a static site generator. From v0.123.0 through v0.16…6.5
• CVE-2026-58407Rejected reason: Please submit CVE requests for each vulnera…
• CVE-2026-58408ChurchCRM is an open-source church management system. Prior …6.5
• CVE-2026-58409ChurchCRM is an open-source church management system. Prior …9.1
• CVE-2026-5841A weakness has been identified in Tenda i3 1.0.0.6(2204). Th…9.8
• CVE-2026-58410ChurchCRM is an open-source church management system. Prior …7.1
• CVE-2026-58411ChurchCRM is an open-source church management system. Prior …7