CVE-2026-58404 gohugoio CVE debrief

Who should care

Users of Hugo static site generator, especially those using versions between 0.162.0 and 0.163.0, should be aware of this vulnerability and take necessary actions to protect their systems. This includes updating to version 0.163.1 or later, reviewing and restricting access to sensitive services, and monitoring for suspicious activity.

Technical summary

The vulnerability in Hugo allows for unauthorized server-side requests due to a weakness in the security.http.urls policy. The policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but only matches dotted-decimal notation, allowing alternate IPv4 encodings to pass through. This issue can be exploited by passing untrusted or data-derived URLs to resources.GetRemote, potentially leading to unauthorized access to internal services.

Defensive priority

Medium High Critical Low Very High Extremely High Not Applicable

Recommended defensive actions

• Update Hugo to version 0.163.1 or later
• Review and restrict access to sensitive services
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was discovered and reported by an unknown source. The CVE record was published on 2026-07-06T20:16:38.307Z and last modified on 2026-07-07T16:16:41.230Z. Evidence is limited, and defenders should verify affected scope and vendor guidance. Additional review of system configurations and monitoring for suspicious activity is recommended.

Official resources