The vulnerability is a blind Server Side Request Forgery that exists in QuantumNous New API versions 0.11.9‑alpha.1 and earlier. A non‑administrative user who has a valid API token can submit a multimodal request to the /v1/chat/completions, /v1/responses, or /v1/messages endpoints and specify the image or file URL host as 0.0.0.0. The code that was intended to block requests to private addresses fails to reject this unspecified address, permitting the server to perform HTTP requests to localhost. When the request is processed through an AWS or Bedrock Claude adaptor, the retrieved content is inserted into the LLM response, effectively turning the blind SSRF into a full‑read SSRF that can expose internal data or code.

The affected product is QuantumNous New API, specifically all releases up to and including 0.11.9‑alpha.1. The fix that hardened the SSRF protection was introduced in v0.9.0.5 and further strengthened in v0.9.6, but the 0.0.0.0 bypass remains present. No publicly available patches exist as of the advisory date. Systems using the affected OpenAI‑compatible endpoints with multimodal input are at risk.

With a CVSS score of 7.1, the vulnerability presents moderate to high severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is via authenticated API calls: an attacker with a valid token can trigger the SSRF. If the request is routed through an AWS/Bedrock adapter, the attack can lead to internal data leakage or code execution, raising the urgency of preventive measures.