CVE-2026-33655: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs

July 7, 2026

The default SSRF protection configuration did not apply IP filtering to hostnames. With ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address. Authenticated users could configure notification URLs for Webhook, Bark, or Gotify notifications and point a hostname at an internal or metadata IP address.

References

github.com/QuantumNous/new-api/commit/20399d3c8fcb4e3649d53163eb11940fd6763743
github.com/QuantumNous/new-api/security/advisories/GHSA-6qcr-qxgr-m7fv
github.com/advisories/GHSA-6qcr-qxgr-m7fv
nvd.nist.gov/vuln/detail/CVE-2026-33655

Code Behaviors & Features

Detect and mitigate CVE-2026-33655 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →