Huginn through version 2022.08.18 contains a server‑side request forgery flaw in the ScenarioImport fetch_url method. Authenticated users can submit crafted URLs that are dereferenced by the application, enabling arbitrary HTTP requests to any destination reachable from the server. This capability allows attackers to probe internal network services, enumerate ports by interpreting error signatures, and access cloud metadata endpoints to retrieve sensitive credentials, threatening confidentiality and integrity of the underlying infrastructure.

The vulnerable component is Huginn; any installation running a release dated 2022.08.18 or earlier is affected. No further minor revisions are specified, so all pre‑2022.09 releases remain at risk.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of <1% suggests a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the Huginn interface, so a user with legitimate credentials can submit a malicious URL through the ScenarioImport interface. The attack path is straightforward: the application blindly forwards the supplied URL, allowing the attacker to target internal or remote services from the server’s network context.