CVE-2026-33655

{
  "id": "CVE-2026-33655",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-09T23:17:04.763",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs that point at an internal or metadata IP address. This issue is fixed in version 0.12.0-alpha.1."
    },
    {
      "lang": "es",
      "value": "La nueva API es una pasarela de modelo de lenguaje grande (LLM) y un sistema de gestión de activos de inteligencia artificial (IA). Antes de la versión 0.12.0-alpha.1, la configuración predeterminada de protección contra SSRF no aplicaba el filtrado de IP a los nombres de host; con ApplyIPFilterForDomain deshabilitado por defecto, la validación de URL comprobaba las reglas de permitir/bloquear dominios, pero no resolvía un nombre de host ni validaba la dirección IP resuelta, lo que permitía a los usuarios autenticados configurar URL de notificación de Webhook, Bark o Gotify que apuntaban a una dirección IP interna o de metadatos. Este problema está solucionado en la versión 0.12.0-alpha.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "QuantumNous",
          "product": "new-api",
          "versions": [
            {
              "version": "< 0.12.0-alpha.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-10T14:16:34.619775Z",
          "id": "CVE-2026-33655",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.12.0",
              "matchCriteriaId": "A595535A-9567-45DD-B891-0A8B18D7D574"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/QuantumNous/new-api/releases/tag/v0.12.0-alpha.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}