QuantumNous new-api, an LLM gateway and AI asset management system, suffers from an SSRF vulnerability (CWE-918) in versions up to 0.11.9-alpha.1. The SSRF protections introduced in earlier versions fail to block the unspecified IP 0.0.0.0, enabling non-admin users with valid API tokens to send multimodal requests to certain endpoints with 0.0.0.0 as the image or file URL host. This bypasses private IP filters and causes the server to issue HTTP requests to localhost. When these requests are routed through an AWS/Bedrock Claude adaptor, the fetched content is embedded into the model response, effectively allowing full-read SSRF. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1. The product is cloud-hosted, and no public patches are currently available.

An attacker with any valid API token can exploit this SSRF vulnerability to make the server issue HTTP requests to localhost, bypassing private IP filters. This can lead to blind SSRF attacks and, when combined with the AWS/Bedrock Claude adaptor, full-read SSRF where fetched content is inlined into model responses. This could expose internal services or sensitive data accessible from localhost. No known exploits are reported in the wild at this time.

As this is a cloud-hosted service, the vendor typically manages remediation server-side. At the time of publication, no public patches are available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, restrict API token distribution and monitor for unusual request patterns involving 0.0.0.0 in URLs if possible.