The New API is an LLM gateway that accepts notification URLs for webhook, Bark, or Gotify endpoints. Prior to version 0.12.0‑alpha.1, the default SSRF protection did not resolve hostnames to apply IP filtering, so authenticated users could configure URLs that point to internal or metadata IP addresses. As a result, the system would send outbound requests to those addresses, potentially exposing internal network resources. It is inferred that an attacker could use such URLs to reach internal services, exfiltrate data, or perform internal port scanning, although the CVE text does not explicitly state these outcomes.

QuantumNous New API deployments released before 0.12.0‑alpha.1 are affected. All builds from 0.11.x and earlier that have not enabled ApplyIPFilterForDomain are vulnerable.

The CVSS score of 7.7 reflects a high impact with authentication required. The EPSS score of less than 1% indicates current exploitation is rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user editing a notification URL that resolves to an internal IP. The flaw exploits a configuration toggle, making remediation straightforward once the patch is applied or the setting is enabled.