Vulnerability details

CVE-2026-33655

QuantumNous new-api

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

CVSS 3.1

7.7High

Official description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs that point at an internal or metadata IP address. This issue is fixed in version 0.12.0-alpha.1.

CVSS scores

Score	Version	Source	Vector
7.7High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
QuantumNous	new-api	< 0.12.0-alpha.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv x_refsource_CONFIRM
https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743 x_refsource_MISC
https://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-10
Last updated: 2026-07-10
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.44%

Probability of exploitation in 30 days

38.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery (SSRF)