New API CVE-2025-59146
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSelf-register low-privilege account
-
DeliverySubmit crafted URL to processing endpoint
-
ExploitServer fetches unvalidated internal URL
-
ExecutionReach metadata/internal services
-
ImpactExfiltrate internal data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account (CVSS PR:L), but exploitation is practically eased because New API ships with user self-registration enabled by default, so any attacker who can reach the web interface can register and then abuse the URL-submission feature that processes user-supplied links (explicitly not limited to image URLs). The limiting factors are: the endpoint must be network-reachable, an account must exist or be creatable (an admin who disables open registration materially raises the bar to PR:L with no easy self-provisioning), and instances running version 0.9.0.5+ are protected by the default-on SSRF module. Pre-patch instances with open registration and no egress firewall are the highest-risk configuration; impact is greatest where the server sits adjacent to cloud metadata endpoints or internal-only services. |
| Impact | This is a credible but not emergency-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, score 8.5) indicates a low-privilege, network-reachable, low-complexity flaw with a changed scope - consistent with SSRF where the vulnerable server pivots to attack other systems. The key amplifier here is contextual, not in the vector: the description states user registration is 'often enabled by default,' meaning the PR:L barrier is frequently trivial to satisfy by self-registering, effectively lowering the real-world authentication bar close to unauthenticated. Against that, the EPSS score is low (0.24%, 14th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced - only the vendor patch commit. Exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (low EPSS + no KEV + no POC = no evidence of active or widespread exploitation yet), with no contradictions between CVSS and description. Net: a genuinely exploitable SSRF in self-hosted AI infrastructure that commonly runs near cloud metadata endpoints and internal services, warranting prompt patching, but with no current evidence of in-the-wild abuse. |
| Exploit ScenarioDerived | An attacker self-registers an account on an exposed New API instance (registration is enabled by default) and submits a crafted URL - not limited to images - to the content-processing endpoint. The server fetches the attacker-controlled URL without validation, allowing the attacker to reach internal-only services or cloud instance metadata (e.g., 169.254.169.254) to harvest credentials or map the internal network. No public proof-of-concept is referenced; only the fixing commit is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Server-side request forgery in New API versions prior to 0.9.0.5 allows any authenticated user to coerce the server into issuing outbound requests to arbitrary internal or external services through a feature that fetches and processes user-supplied URLs. Because user self-registration is enabled by default, an attacker who can reach the web interface can typically create an account and trigger the endpoint, which is not limited to image URLs and accepts any link. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, 8.5) reflects high confidentiality impact via access to internal-only services or cloud metadata endpoints; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.24% (14th percentile). The issue is fixed in 0.9.0.5.
RemediationAI
Vendor-released patch: 0.9.0.5. Upgrade New API to 0.9.0.5 or later, which introduces a comprehensive, user-configurable SSRF protection module that is enabled by default and provides granular control over outbound requests (private-IP blocking via 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopback, link-local and IPv6 equivalents, plus domain and port allow/deny lists). Confirm the protection is active after upgrading and review its domain/IP/port allow-lists so legitimate integrations are not broken; tightening these lists may block expected outbound calls, so validate in a non-production environment first. For users who cannot upgrade immediately, the advisory recommends two temporary mitigations: enable the new-api image processing worker (new-api-worker) so URL fetching is offloaded and constrained, and/or configure egress firewall rules; note that enabling the worker may change the deployment topology and add operational overhead, while egress rules can break legitimate integrations and must be scoped carefully. Additionally, disabling open self-registration raises the effective privilege prerequisite from a freely creatable account to an existing one, materially reducing exposure. Detailed guidance is in the GitHub advisory GHSA-xxv6-m6fx-vfhh (https://github.com/QuantumNous/new-api/security/advisories/GHSA-xxv6-m6fx-vfhh) and the fixing commit https://github.com/QuantumNous/new-api/commit/ef634160986c6f6b087cbfe131074fda862928af.
Affected ProductsAI
New API (QuantumNous/new-api) versions prior to 0.9.0.5 are affected; the vulnerability is patched in 0.9.0.5. The project is the LLM gateway/AI asset management system distributed as a Go application, and no CPE string was supplied in the available intelligence, so affected scope should be determined by deployed version rather than by CPE matching. The official advisory is GHSA-xxv6-m6fx-vfhh at https://github.com/QuantumNous/new-api/security/advisories/GHSA-xxv6-m6fx-vfhh, and the fixing commit is https://github.com/QuantumNous/new-api/commit/ef634160986c6f6b087cbfe131074fda862928af. Administrators should inventory all New API instances and confirm their running version against the 0.9.0.5 baseline; instances with default configuration (open registration) and network exposure are the highest-priority targets for review.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
New API is a Go-based LLM gateway and AI asset management platform, and this is a classic CWE-918 server-side request forgery. The vulnerable code path accepts a user-supplied URL and makes a server-side fetch without validating the destination, so an attacker controls the host, port, and scheme of the request. The upstream fix commit (ef634160986c6f6b087cbfe131074fda862928af) adds common/ip.go and common/ssrf_protection.go, introducing an SSRFProtection struct with configurable allow/deny modes for domains and IPs, an AllowedPorts list supporting single ports and ranges (e.g., "8000-9000"), and a private-IP detector covering 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16, multicast and reserved blocks, plus IPv6 loopback, link-local (fe80::/10), and unique-local (fc00::/7) ranges. The default configuration blocks private IPs and uses allow-list filtering, meaning the protection is enabled by default after upgrade. The high confidentiality rating in the assessed vector is consistent with SSRF against adjacent internal services or cloud metadata, while the low integrity rating reflects that the primary impact is unauthorized read/reach rather than data modification.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Authenticated (PR:L) but low-barrier via default self-registration; network vector, low complexity; SSRF pivots beyond the app (S:C) exposing internal/metadata data (C:H), with limited integrity and no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in versions prior to 0.9.0.5. A feature within the application allows authenticated users to submit a URL for the server to process its content. The application fails to properly validate this user-supplied URL before making a server-side request. This vulnerability is not limited to image URLs and can be triggered with any link provided to the vulnerable endpoint. Since user registration is often enabled by default, any registered user can exploit this. By crafting a malicious URL, an attacker can coerce the server to send requests to arbitrary internal or external services. The vulnerability has been patched in version 0.9.0.5. The patch introduces a comprehensive, user-configurable SSRF protection module, which is enabled by default to protect server security. This new feature provides administrators with granular control over outbound requests made by the server. For users who cannot upgrade immediately, some temporary mitigation options are available. Enable new-api image processing worker (new-api-worker) and/or configure egress firewall rules.
Executive ViewAI
New API versions prior to 0.9.0.5 contain a server-side request forgery vulnerability that lets an authenticated user-including one who self-registers-force the server to access internal services or cloud metadata, which can expose sensitive credentials and internal-only data. Although no public exploit identified at time of analysis, the default self-registration setting means any attacker who can reach the web interface can likely trigger the flaw. Leadership should treat this as a high-priority exposure because it can lead to credential theft and lateral movement within the environment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB