# huginn v2026.08.27

- Product: huginn (https://whatsnew.fyi/product/huginn)
- Vendor: huginn
- Date: 2026-08-27
- Version: v2026.08.27
- Original notes: https://github.com/huginn/huginn/releases/tag/v2026.08.27
- Permalink: https://whatsnew.fyi/product/huginn/releases/v2026.08.27

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix command injection vulnerability in PdfInfoAgent where a crafted event URL could execute arbitrary shell commands even when insecure Agents were disabled
- **security** — Fix authorization vulnerability allowing an authenticated user to bind another user's private OAuth Service to an Agent
- **security** — Fix authorization vulnerability allowing an authenticated user to manually trigger event propagation across other users' Agents
- **security** — Fix duplicate event delivery issue caused by concurrent propagation scans delivering the same event more than once

This security release fixes four issues:

- A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled.
- An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential.
- An authenticated user could manually trigger event propagation across other users' Agents.
- Concurrent propagation scans could deliver the same event more than once.

The command-injection issue affects installations where untrusted users can create and connect Agents.  The two authorization issues affect multi-user installations.  The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work.  Operators should upgrade promptly.  The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review.

Full details:

- https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842
- https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw
- https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj
- https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw

**Full Changelog**: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27