VulnSocial

CVE-2026-42339Disclosure(newapi / new_api)

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block the unspecified address 0.0.0.0. A regular (non-admin) user holding any valid API token can send a multimodal request to /v1/chat/completions, /v1/responses, or /v1/messages with 0.0.0.0 as the image/file URL host, bypassing the private-IP filter and causing the server to issue HTTP requests to localhost. This constitutes at minimum a blind SSRF; when the request is routed through an AWS/Bedrock Claude adaptor, the fetched content is inlined into the model response, upgrading it to a full-read SSRF. At time of publication, there are no publicly available patches.

newapi CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • new_api

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
newapi
Products
new_api

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-09: 2Technical Details · 2026-05-09: 205-09
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-42339 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection int… https://www.cve.org/CVERecord?id=CVE-2026-42339

    Post summary

    The post briefly announces CVE‑2026‑42339, noting that versions 0.11.9‑alpha.1 and earlier of the New API contain an SSRF flaw.

    0000076
    57.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-42339 Server-Side Request Forgery via Unspecified Address in New API Versions 0.11.9-alpha.1 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42339

    Post summary

    The brief post announces CVE‑2026‑42339 as a Server‑Side Request Forgery affecting API 0.11.9‑alpha.1 and earlier; no evidence of exploitation, PoC, or patch details is provided.

    0000044
    4.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appnewapinew_api---
Appnewapinew_api0.11.9--

Explore more

Back to dashboardnewapi CVEsnew_api vulnerabilities