Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces     security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx     redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the     request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The     same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is     fixed in 0.162.0. (CVE-2026-50134)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces
    security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx
    redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the
    request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The
    same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is
    fixed in 0.162.0. (CVE-2026-50134)

ID	Name	Product	Family	Severity
325410	Linux Distros Unpatched Vulnerability : CVE-2026-50134	Nessus	Misc.	medium
443266	SCA: security update for github.com/gohugoio/hugo (GHSA-vxgm-5rmg-5w8g)	Tenable Cloud Security	SCA Checks	medium
443266	SCA: security update for github.com/gohugoio/hugo (GHSA-vxgm-5rmg-5w8g)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-50134

medium

Tenable Plugins

medium

medium

medium