{"items":[{"id":"NVI-00017780","kind":"vulnerability","title":"New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6qcr-qxgr-m7fv","CVE-2026-33655"],"plain_summary":"GitHub lists this reviewed advisory for github.com/QuantumNous/new-api. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-62b123bfa54ce04b01b53d3d7d652695"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-07T13:01:13.000Z","value":"7.7 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-62b123bfa54ce04b01b53d3d7d652695"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-62b123bfa54ce04b01b53d3d7d652695","url":"https://github.com/advisories/GHSA-6qcr-qxgr-m7fv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6qcr-qxgr-m7fv","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:51.634Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-62b123bfa54ce04b01b53d3d7d652695"],"technology":"github.com/QuantumNous/new-api","known_exclusions":[],"conditions_summary":"## Summary\n\nThe default SSRF protection configuration did not apply IP filtering to hostnames. With `ApplyIPFilterForDomain` disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address. Authenticated users could configure notification URLs for Webhook, Bark, or Gotify notifications and point a hostname at an internal or metadata IP address.\n\n## Impact\n\nA regular authenticated user could cause the server to send notification requests to internal HTTP services reachable from the deployment network. Depending on the target environment, this could expose sensitive internal data through timing, errors, or response-dependent behavior. The issue is rated High.\n\n## Affected versions\n\nVersions before `v0.12.0-alpha.1` are affected. The previous affected range of `<= v0.11.4-alpha.4` was too narrow because the unsafe default remained present until the `v0.12.0-alpha.1` fix.\n\n## Patches\n\nThis issue is fixed in `v0.12.0-alpha.1`. The default fetch setting now sets `ApplyIPFilterForDomain: true`, causing hostname destinations to be resolved and checked against the configured IP filtering rules during URL validation.\n\nT","public_affected_ranges":["< 0.12.0-alpha.1"]}],"null_published_at":"2026-11-05T19:10:21.467Z","source_updated_at":"2026-07-07T13:01:13.000Z","source_disclosed_at":"2026-07-07T13:01:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:51.634Z"}],"next_cursor":null,"snapshot_revision":"42594"}