v2026.09.08

This security release fixes three issues:

- A Scenario description containing HTML could execute script in the browser of a user importing the Scenario, both in the import preview and after the import.  Scenario icons were likewise stored without validation.
- Any authenticated user could read any file readable by the Huginn process by handing a file pointer to a file-consuming Agent, even with `ENABLE_INSECURE_AGENTS` disabled.  Reading `.env` exposes `APP_SECRET_TOKEN`, which allows forging an administrator session.
- Pages served by LiquidOutputAgent, DataOutputAgent and other web request handlers ran on Huginn's own origin, so a page authored by one user could act on Huginn as another user viewing it.

The file-read issue affects installations where untrusted users have accounts.  Operators of such installations should rotate `APP_SECRET_TOKEN` and any other secrets stored in `.env` after upgrading, since a secret leaked before the fix remains usable.  The Scenario import issue affects anyone importing a Scenario from an untrusted source.  The web request issue affects multi-user installations.  Operators should upgrade promptly.

Responses from the web request route now carry `Content-Security-Policy: sandbox allow-scripts allow-forms allow-popups`.  Pages that relied on calling Huginn's own API from within a served page will stop working.

This release also hardens deployment defaults:

- The Docker configurations no longer ship a fixed `APP_SECRET_TOKEN`.  A random one is generated on container start unless `APP_SECRET_TOKEN` is set; set it to a value of your own to keep sessions valid across container restarts.  Deployments still supplying the previously shipped value get a warning and a generated secret instead.
- `rake db:seed` generates a random admin password and prints it once unless `SEED_PASSWORD` is set.
- DataOutputAgent and LiquidOutputAgent get a random default secret.
- Devise paranoid mode is enabled, so the password reset, unlock and confirmation forms no longer reveal whether an account exists.
- TwitterStreamAgent is retired, as the Twitter streaming API it depended on was shut down in 2023.  Existing Agents remain loadable but new ones cannot be created.

Full details:

- https://github.com/huginn/huginn/security/advisories/GHSA-x738-j22q-h2jw
- https://github.com/huginn/huginn/security/advisories/GHSA-p347-7m45-694r
- https://github.com/huginn/huginn/security/advisories/GHSA-p748-5grc-mcf5

**Full Changelog**: https://github.com/huginn/huginn/compare/v2026.08.27...v2026.09.08