Most recent entries from all

EUVD-2026-309945

2026-10-06T06:22:32.128539+00:00

EUVD-2026-309945

fkie_cve-2026-42339

2026-10-06T06:22:32.128576+00:00

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block the unspecified address 0.0.0.0. A regular (non-admin) user holding any valid API token can send a multimodal request to /v1/chat/completions, /v1/responses, or /v1/messages with 0.0.0.0 as the image/file URL host, bypassing the private-IP filter and causing the server to issue HTTP requests to localhost. This constitutes at minimum a blind SSRF; when the request is routed through an AWS/Bedrock Claude adaptor, the fetched content is inlined into the model response, upgrading it to a full-read SSRF. At time of publication, there are no publicly available patches.

GHSA-v5c3-6wvc-pc2q — QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0

2026-10-06T06:22:32.128611+00:00

Affected: Go: github.com/QuantumNous/new-api

# SSRF Filter Bypass via `0.0.0.0`

### Summary

The SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block the unspecified address `0.0.0.0`. A regular (non-admin) user holding any valid API token can send a multimodal request to `/v1/chat/completions`, `/v1/responses`, or `/v1/messages` with `0.0.0.0` as the image/file URL host, bypassing the private-IP filter and causing the server to issue HTTP requests to localhost. This constitutes at minimum a **blind SSRF**; when the request is routed through an AWS/Bedrock Claude adaptor, the fetched content is inlined into the model response, upgrading it to a **full-read SSRF**.

### Details

#### Root Cause

`common/ssrf_protection.go` — `isPrivateIP()` (lines 33–47) checks the following ranges:

- `10.0.0.0/8` - `172.16.0.0/12` - `192.168.0.0/16` - `127.0.0.0/8` - `169.254.0.0/16` - `224.0.0.0/4` - `240.0.0.0/4`

**`0.0.0.0/8` is not checked.** On Linux, `0.0.0.0` resolves to the local machine, same as `127.0.0.1`.

#### Default Fetch Settings

`setting/system_setting/fetch_setting.go` (lines 16–24) defaults:

- `EnableSSRFProtection: true` - `AllowPrivateIp: false` - `AllowedPorts: ["80", "443", "8080", "8443"]` - `ApplyIPFilterForDomain: true`

So `0.0.0.0` on any of these four ports passes all checks.

#### Data Flow (primary chain — `/v1/chat/completions`)

``` User API token → /v1/chat/completions (TokenAuth, no admin required) → messages[].content[].image_url.url =…