High severity · published Jun 25, 2026
CVE-2026-56769
Huly Platform - Server-Side Request Forgery via /import Endpoint
8.5
CVSS
0.4%
EPSS
No
On KEV
Description
Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
platform · hcengineering
through 0.7.423 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56769
github.com
https://github.com/hcengineering/platform/commit/68cbf8a88642d8313f151a274fb5c24dee6a2762
github.com
https://github.com/hcengineering/platform/issues/10892
github.com
https://github.com/hcengineering/platform/pull/10910
www.vulncheck.com
https://www.vulncheck.com/advisories/huly-platform-server-side-request-forgery-via-import-endpoint
More from platform
8.5
CVE-2026-91079
Huly Platform through 0.7.426 SSRF via Print Service