Novu allowed unvalidated chat webhook URLs in several endpoints, making it possible for an authenticated user to direct outbound POST requests from the Novu worker to any IP address. The vulnerability, identified as a server‑side request forgery (CWE‑918), permits the attacker to reach internal or otherwise restricted services without additional authentication, creating a potential channel for data exfiltration or internal service manipulation.

The flaw affects Novu API Service and Novuhq Novu products running any version earlier than 3.18.0. These versions accept webhook URLs from subscriber credentials, channel endpoint, event payload, and event overrides and forward them to the chat providers without normalizing the URL or applying DNS‑pinned safety checks.

The CVSS score of 5.3 indicates a moderate severity, yet the absence of an EPSS score and non‑listing in KEV suggests limited known exploitation. An attacker typically needs valid credentials to supply a malicious URL; nevertheless, once an endpoint is configured, the worker can perform arbitrary HTTP actions against any internal service the Novu environment can reach, potentially compromising confidentiality, integrity, or availability of those services.