Vulnerability Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs that point at an internal or metadata IP address. This issue is fixed in version 0.12.0-alpha.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Newapi | New Api | < 0.12.0 |
Related Weaknesses (CWE)
References
- https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6Patch
- https://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1Release Notes
- https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fvThird Party Advisory
FAQ
What is CVE-2026-33655?
CVE-2026-33655 is a vulnerability with a CVSS score of 7.7 (HIGH). New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering t...
How severe is CVE-2026-33655?
CVE-2026-33655 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33655?
Check the references section above for vendor advisories and patch information. Affected products include: Newapi New Api.