Novu EUVD-2026-84536

Requires an authenticated Novu account (PR:L) with the ability to supply a chat webhook URL via subscriber credentials.webhookUrl, channel endpoint.url, event payload.webhookUrl, or event overrides.webhookUrl, and to trigger delivery through one of the affected chat providers (Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, or Zulip) - these paths omit normalizeOutboundHttpUrl, assertSafeOutboundUrl, and the DNS-pinned safeOutboundJsonRequest checks. Exploitation further requires that the Novu worker have network reachability to the intended internal target. Limiting factors: valid authentication is mandatory, the primitive is a POST-only, largely blind SSRF (impact bounded to interactions/actions on the internal service, not arbitrary read or code execution), and it is fixed in v3.18.0.

This is a genuine but moderate-severity SSRF (CWE-918). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L = 5.3) indicates a network-reachable, low-complexity flaw requiring authentication (PR:L), with only LOW impact across confidentiality, integrity, and availability on both the vulnerable and subsequent systems - consistent with a largely blind, POST-only SSRF rather than a full read/RCE primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The requirement for a valid authenticated Novu account plus the ability to configure a chat-provider webhook URL meaningfully limits the attacker population, and the impact is bounded to internal POST interactions rather than data exfiltration or code execution. Net assessment: a real, patch-worthy issue for organizations running self-hosted Novu with internal network exposure, but not an emergency - no evidence of widespread or automated exploitation. The signals are internally consistent (no CVSS-vs-description conflict); the main missing signals are EPSS/KEV/POC, whose absence is expected for a freshly-disclosed niche-OSS advisory.

An authenticated Novu user configures a chat channel (e.g., Discord, Slack, Microsoft Teams, or Grafana On-Call provider) with a webhook URL pointing at an internal service such as a cloud metadata endpoint or an internal admin API, then triggers a notification event. The Novu worker issues an attacker-directed POST to that internal destination - bypassing the DNS-pinned safeOutboundJsonRequest protections used by the generic webhook providers - causing interactions or actions on services not meant to be reachable externally. No public exploit code was identified, but the attack is straightforward given the documented unprotected endpoint paths.