The Huly Platform through version 0.7.423 contains an authenticated server‑side request forgery flaw in the /import endpoint of its front pod. This weakness allows authenticated workspace users to supply arbitrary URLs, causing the platform to issue outbound requests to any IP address or hostname. Attackers can use this capability to reach internal services, capture and exfiltrate HTTP responses, and replay captured credentials against backend systems. The primary consequence is information disclosure and credential theft, with potential internal network compromise if sensitive endpoints are queried.

All instances of Huly Platform version 0.7.423 or earlier that use the front pod are affected. The vulnerability exists until the platform is updated to include the fix in commit 68cbf8a88642d8313f151a274fb5c24dee6a2762, which removes the unsafe URL handling from the /import endpoint.

The CVSS score of 6.3 indicates a moderate the CISA KEV catalog. Exploitation requires the attacker to be a legitimate authenticated workspace user; once authenticated, the attacker can generate arbitrary outbound requests and exfiltrate data or replay credentials, potentially escalating privilege within the internal network.