Is CVE-2026-75511 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75511 being exploited in the wild.

How severe is CVE-2026-75511?

Informational severity, published 22 September 2026.

Is there a fix for CVE-2026-75511?

A patch was published on 2026-06-07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75511 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-75511?

Check whether you run Novu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75511: Novu improper webhook URL validation in chat providers

CVE-2026-75511 · Severity: info · Published 2026-09-22

Novu is a notification platform that routes messages across multiple channels including chat services. Prior to version 3.18.0, authenticated users could supply webhook URLs pointing to internal network services, allowing the Novu worker to issue HTTP requests to restricted destinations. An attacker could exploit this to interact with internal APIs or trigger unauthorized actions on internal systems.

Technologies: Novu. Vendors: Novu.

Quick answers

Is CVE-2026-75511 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75511 being exploited in the wild.
How severe is CVE-2026-75511?: Informational severity, published 22 September 2026.
Which products and versions are affected?: Novu before 3.18.0.
Is there a fix for CVE-2026-75511?: A patch was published on 2026-06-07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75511 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-75511?: Check whether you run Novu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Nine chat providers (Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip) accepted webhook URLs from subscriber credentials, channel endpoints, and event payloads, then passed them to raw HTTP requests via axios without applying URL normalization, outbound URL validation, or DNS-pinned request protections. An authenticated attacker could supply internal or restricted URLs to bypass SSRF protections and cause the Novu worker to make HTTP POST requests to internal network services. The issue is fixed in 3.18.0 by routing all chat webhook delivery through a centralized safe-chat-webhook-request helper that applies consistent outbound URL validation.

Affected products

Novu Novu before 3.18.0

Timeline

2026-09-22: disclosed
2026-06-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.