CVE-2026-33655: New API SSRF Vulnerability in Notification URLs

Technical summary

This is a Server-Side Request Forgery (CWE-918) vulnerability in New API's notification URL validation logic. The application checks domain names against allow/block rules but fails to resolve hostnames to IP addresses and validate those IPs. Because ApplyIPFilterForDomain defaulted to off, authenticated users could register notification URLs with hostnames that resolve to RFC 1918 private addresses, loopback ranges, or cloud metadata endpoints (e.g., 169.254.169.254 on AWS). The fix, implemented in 0.12.0-alpha.1, likely enables IP filtering by default and validates resolved addresses against an internal blocklist. The SSRF is confined to notification delivery channels and requires prior authentication, limiting but not eliminating impact.

Business impact

Organizations running New API risk exposure of internal service discovery information, configuration secrets, and cloud provider credentials if notification URLs are misconfigured or manipulated by a compromised or malicious user account. In AWS, GCP, or Azure environments, access to metadata services can yield temporary credentials with attached permissions, leading to lateral movement and data exfiltration. This is particularly acute for shared or multi-tenant deployments where multiple teams manage notification integrations. The vulnerability does not enable code execution or availability attacks directly, but data confidentiality is at risk.

Affected systems

New API versions prior to 0.12.0-alpha.1 are vulnerable. The issue affects any deployment where notification features (Webhook, Bark, Gotify) are enabled and users with API or configuration privileges are present. Self-managed instances and cloud-hosted versions are both at risk. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date, but presence in an AI/ML platform suggests potential appeal to threat actors targeting infrastructure security or supply-chain reconnaissance.

Exploitability

Exploitation requires prior authentication to the New API platform and access to notification configuration interfaces. No unauthenticated path exists. An attacker must either be a legitimate user or compromise an existing account. The technical barrier to exploitation is low—simply entering a hostname that resolves to an internal IP in a notification URL field—making it likely to be weaponized once word spreads in internal security forums. There is no public exploit code referenced, but the attack pattern is straightforward. Automated scanning for exposed New API instances and credential stuffing campaigns would increase real-world risk.

Remediation

Upgrade New API to version 0.12.0-alpha.1 or later immediately. Before patching, restrict access to notification configuration endpoints via role-based access control, limiting to trusted administrators. Audit existing notification URLs in your deployment for any that reference internal hostnames or private IP ranges; remove or update them. If ApplyIPFilterForDomain is a user-configurable setting in your current version, enable it explicitly. For cloud deployments, ensure that metadata service access is restricted at the network/security group level as an additional layer. Test the patch in a non-production environment first, as alpha releases may introduce other instabilities.

Patch guidance

The fix is available in version 0.12.0-alpha.1. Consult the New API release notes for any breaking changes or migration guidance specific to your deployment model. If you are on a stable release channel that has not yet incorporated this fix, contact the vendor for an expected timeline or request a backport. Plan patching around your change management calendar, but prioritize this given the high CVSS score (7.7) and the ease of exploitation. Verify in your test environment that notification systems (Webhook, Bark, Gotify) continue to function correctly after upgrade, and confirm that any previously configured internal notification URLs are flagged or rejected by the new validation logic.

Detection guidance

Monitor New API logs for notification configuration changes, especially any involving private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or metadata service IPs (169.254.169.254 in AWS, 169.254.169.254 in GCP, 168.63.129.16 in Azure). Look for failed webhook delivery attempts to unusual internal endpoints. Implement network egress controls that block outbound requests from New API to private ranges and metadata services, forcing legitimate notifications to external services only. Conduct a manual audit of all configured notification URLs in your instance and correlate with user activity logs to identify potential malicious changes. If you lack detailed audit logs, upgrade to 0.12.0-alpha.1 and then review what was configured in the interim.

Why prioritize this

This vulnerability merits immediate attention (within 1–2 weeks) because it enables credential and configuration theft in cloud and on-premises environments, the barrier to exploitation is trivial for an authenticated user, and no public patch evasion is known. While authentication is required, insider threats and account compromise are common attack vectors. The CVSS of 7.7 reflects high confidentiality impact and network scope. Organizations running New API in AWS, GCP, or Azure should especially accelerate patching, as metadata service access is a direct path to privilege escalation. The alpha version status does not reduce urgency; it reflects New API's current maturity, not the severity of the issue.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) is driven by: (1) High Confidentiality impact (C:H) due to potential exposure of secrets and metadata; (2) Network-adjacent vector (N) and low attack complexity (L), as the attacker only needs to set a configuration field; (3) Scope Change (S:C), meaning the attacker's actions can affect resources beyond the vulnerable component (metadata services, other internal systems); (4) Low Privilege requirement (L) since any authenticated user can trigger the misconfiguration, not just admins. Integrity is not directly affected (I:N) because the attacker cannot modify data on the internal target, only read it. The score appropriately reflects a confidentiality-focused vulnerability that is practical to exploit but constrained by the authentication requirement.

Frequently asked questions