---
id: CVE-2026-56769
title: Huly Platform - Server-Side Request Forgery via /import Endpoint
summary: >-
  Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an
  authenticated server-side request forgery vulnerability in the /import
  endpoint of front pod that allows workspace users to make arbitrary server
  requests. Attackers can …
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: hcengineering
product: platform
affected:
  - platform <= 0.7.423
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-25T18:29:05.184153Z'
exploitAvailable: true
published: '2026-06-25'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:17.678Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56769'
references:
  - url: 'https://github.com/hcengineering/platform/issues/10892'
    label: Researcher Disclosure
  - url: 'https://github.com/hcengineering/platform/pull/10910'
    label: Pull Request
  - url: >-
      https://github.com/hcengineering/platform/commit/68cbf8a88642d8313f151a274fb5c24dee6a2762
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/huly-platform-server-side-request-forgery-via-import-endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00369
epssPercentile: 0.30966
ingestedAt: '2026-11-08T14:51:22.342Z'
---

## Overview

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.

## Affected

- `platform <= 0.7.423`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.