CVE-2025-59146: SSRF in New API LLM Gateway

The SSRF vulnerability in New API allows an authenticated attacker to craft malicious URLs that the server will then process. This bypasses intended security controls, enabling the attacker to potentially access internal resources, sensitive data, or even interact with other systems behind the firewall. The scope of the attack is limited by the attacker's ability to craft URLs that the server will accept. Successful exploitation could lead to information disclosure, privilege escalation (if internal services are accessible), and potentially even denial-of-service if the attacker can trigger resource exhaustion on the server or target systems. While user registration is often enabled by default, this makes exploitation easier.

1. Reserved2025-09-09
2. Published2025-10-09
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59146 is to immediately upgrade New API to version 0.9.0.5 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict URL validation on the server-side, restricting access to the vulnerable endpoint, and implementing a Web Application Firewall (WAF) with rules to block suspicious URL patterns. Monitor access logs for unusual outbound requests originating from the New API server.