By vendor

Newapi vulnerabilities

Known CVEs affecting Newapi products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-33655HIGH 7.7

  New API is an AI gateway and asset management platform. Versions prior to 0.12.0-alpha.1 suffer from inadequate validation of internal IP addresses in notification webhook configurations. An authenticated attacker can bypass hostname filtering to point notification endpoints (Webhook, Bark, or Gotify) at internal servers or cloud metadata services, potentially exfiltrating sensitive configuration and credentials. The root cause is that domain allow/block rules were applied, but resolved IP addresses were never validated against an internal IP blocklist—a setting (ApplyIPFilterForDomain) that was disabled by default. The vulnerability requires authentication and has limited scope within the notification system, but access to metadata services represents elevated risk in cloud environments.

• CVE-2026-44342MEDIUM 5.3

  New API, an LLM gateway and AI asset management platform, contains a cross-site request forgery (CSRF) vulnerability in its account binding functionality. Versions before 0.12.0-alpha.1 use GET requests for sensitive operations that should require POST, allowing attackers to trick logged-in users into binding attacker-controlled email addresses or OAuth identities to their accounts without explicit consent. The vulnerability requires an attacker to craft a malicious link or webpage and relies on a user clicking it while authenticated to New API, but the impact—account takeover through OAuth binding—is significant enough to warrant immediate attention.