v2026.08.27

This security release fixes four issues:

- A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled.
- An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential.
- An authenticated user could manually trigger event propagation across other users' Agents.
- Concurrent propagation scans could deliver the same event more than once.

The command-injection issue affects installations where untrusted users can create and connect Agents.  The two authorization issues affect multi-user installations.  The duplicate-delivery issue can affect any installation when propagation scans overlap and receivers perform non-idempotent work.  Operators should upgrade promptly.  The Service-binding migration disconnects unauthorized private bindings and disables affected Agents for administrator review.

Full details:

- https://github.com/huginn/huginn/security/advisories/GHSA-fc8p-86r3-g842
- https://github.com/huginn/huginn/security/advisories/GHSA-73v6-mq4f-33gw
- https://github.com/huginn/huginn/security/advisories/GHSA-7824-m5cr-8pgj
- https://github.com/huginn/huginn/security/advisories/GHSA-x7pc-rrfc-4chw

**Full Changelog**: https://github.com/huginn/huginn/compare/v2022.08.18...v2026.08.27