Novu’s conditions filter webhook passes a user‑defined webhookUrl directly to a worker’s HTTP client without validating the target address, allowing an attacker to trigger outbound POST requests to arbitrary internal or private services. The response payload is returned to the workflow condition evaluator and stored in execution details, which are exposed through a public GET endpoint. This enables disclosure of sensitive data or credentials from internal metadata services or other services that respond to POST.

The issue exists in all Novu releases prior to version 3.15.0, including the 3.14.x series and earlier. Any deployment that exposes the conditions filter endpoint without the 3.15.0 safeguard is vulnerable.

With a CVSS score of 8.3 the vulnerability is high severity. No EPSS score is provided, and it is not listed in the CISA KEV catalog, suggesting the exploitation probability is unclear but potentially significant. The likely attack vector is an attacker creating a workflow condition with a malicious webhookUrl and triggering it; no special privileges are required on the Novu server. The exposure of execution details via a public endpoint can leak credentials or internal service data, making this a powerful foothold for lateral movement or data exfiltration.