CVE-2026-33655 Details

A server-side request forgery (SSRF) vulnerability has been identified in New API, a large language model gateway and AI asset management system, in versions prior to 0.12.0-alpha.1. The issue arises because the default SSRF protection did not apply IP filtering to hostnames. With the 'ApplyIPFilterForDomain' setting disabled by default, URL validation only checked domain allow/block rules without resolving the hostname to validate the IP address. This allowed authenticated users to configure notification URLs that pointed to internal or metadata IP addresses, potentially exposing sensitive data.

Users can upgrade to New API version 0.12.0-alpha.1, where this vulnerability is fixed. The update includes a change that sets 'ApplyIPFilterForDomain' to true by default, ensuring that hostname destinations are resolved and checked against IP filtering rules during URL validation. For those unable to upgrade immediately, it is recommended to manually enable 'ApplyIPFilterForDomain', restrict notification URL domains with an allowlist, disable user-configurable notification URLs where practical, and enforce outbound network filtering at the host or network layer.