Executive brief
New API, a gateway for managing AI models and assets, contains a security flaw that allows users to bypass internal network protections. By using a specific network address (0.0.0.0), an attacker with a standard user account can force the server to connect to its own internal services or other private resources. This could lead to the exposure of sensitive internal data, such as system configuration files or private documents, especially when processed through certain AI models like Claude.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in New API versions up to v0.11.9-alpha.1 due to an incomplete IP blacklist in 'common/ssrf_protection.go'. While the application attempts to block private IP ranges (like 127.0.0.1), it fails to account for the 'unspecified' address 0.0.0.0, which resolves to the local host on Linux systems. An authenticated user can exploit this by submitting multimodal requests (e.g., to /v1/chat/completions) with a malicious URL. When processed via specific adaptors like AWS/Bedrock Claude, the server fetches the internal resource and inlines it into the model's context, allowing the attacker to read the content via the model's output. No patch was available at the time of the advisory.
Affected products
- QuantumNous new-api <= v0.11.9-alpha.1
Timeline
- 2026-05-06: advisory: Original GitHub security advisory published
- 2026-05-08: disclosed: CVE-2026-42339 published to NVD