CVE-2026-33655CWE-918

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

High · published July 9, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs that point at an internal or metadata IP address. This issue is fixed in version 0.12.0-alpha.1.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-09T22:28Z
EPSS history
Timeline
  • 09 JUL 22:28Z
    New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
    cvelistv5