{"id":"CVE-2026-125114","kind":"vulnerability","aliases":["CVE-2026-125114","GHSA-4x48-cgf9-q33f"],"related":[],"title":"Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection","description":"## Summary\n\nThe conditions filter webhook at `libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts` line 261 sends POST requests to user-configured URLs using raw `axios.post()` with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses `validateUrlSsrf()` which blocks private IP ranges. The conditions webhook was not included in this protection.\n\n## Root Cause\n\n`conditions-filter.usecase.ts` line 261:\n```typescript\nreturn await axios.post(child.webhookUrl, payload, config).then((response) => {\n  return response.data as Record<string, unknown>;\n});\n```\n\nNo call to `validateUrlSsrf()`. The `webhookUrl` comes from the workflow condition configuration with zero validation.\n\n## Protected Code (for contrast)\n\n`execute-http-request-step.usecase.ts` line 130:\n```typescript\nconst ssrfValidationError = await validateUrlSsrf(url);\nif (ssrfValidationError) {\n  // blocked\n}\n```\n\nThis function resolves DNS and checks against private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16). It exists in the codebase but is not applied to the conditions webhook path.\n\n## Proof of Concept\n\n1. Create a workflow with a condition step\n2. Configure the condition's webhook URL to `http://169.254.169.254/latest/meta-data/iam/security-credentials/`\n3. Trigger the workflow by sending a notification event\n4. The worker evaluates the condition and calls `axios.post()` to the metadata endpoint\n5. The response data is stored in execution details and accessible via the execution details API\n\n## Impact\n\nFull-read SSRF. The response body is returned as `Record<string, unknown>` for condition evaluation and stored in the execution details `raw` field. The `GET /execution-details` API returns this data.\n\nThe POST method limits some metadata endpoints (GCP requires GET, Azure requires GET), but AWS IMDSv1 accepts POST and returns credentials. Internal services accepting POST are also reachable.\n\n## Suggested Fix\n\nExtract `validateUrlSsrf()` to a shared utility and call it before the axios.post in conditions-filter.usecase.ts:\n\n```typescript\nconst ssrfError = await validateUrlSsrf(child.webhookUrl);\nif (ssrfError) {\n  throw new Error('Webhook URL blocked by SSRF protection');\n}\nreturn await axios.post(child.webhookUrl, payload, config)...\n```","summary":"Novu's conditions filter webhook sends POST requests to user-configured URLs without the SSRF validation that the HTTP Request workflow step applies. An attacker who can create workflows can make the server reach internal addresses such as cloud metadata endpoints and read the response data through the execution details API.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@novu/api","fixed":["3.15.0"],"affected":"< 3.15.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["@novu/api","cloud-metadata","cwe-918","novu","package","self-hosted"],"not_affected_if":["managed-hosting","no-condition-webhooks","version-3.15.0-or-later"],"how_to_check":"- Check the installed `@novu/api` version in `package.json` or the lockfile; affected versions are below `3.15.0`.\n- Look for workflows containing condition steps with a webhook URL set to private or link-local addresses such as `169.254.169.254`.\n- Confirm whether untrusted users can create or edit workflows in your Novu instance.","fix":"- `@novu/api`: move to `3.15.0` or later.","status":"open","published_at":"2026-04-14T23:22:48+00:00","first_seen_at":"2026-11-09T22:15:29+00:00","triaged_at":"2026-11-09T22:16:26+00:00","updated_at":"2026-11-09T22:16:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:16:26Z","model":"claude-haiku-5-5","output":{"fix":"- `@novu/api`: move to `3.15.0` or later.","reach":"network","title":"Novu: workflow condition webhook skips SSRF checks, reads internal responses","impact":"high","summary":"Novu's conditions filter webhook sends POST requests to user-configured URLs without the SSRF validation that the HTTP Request workflow step applies. An attacker who can create workflows can make the server reach internal addresses such as cloud metadata endpoints and read the response data through the execution details API.","audience":"developers","category":"package","nicknames":[],"who_cares":["novu","@novu/api","self-hosted","cloud-metadata"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Server reads cloud credentials and internal service responses via API","analyst_note":"","how_to_check":"- Check the installed `@novu/api` version in `package.json` or the lockfile; affected versions are below `3.15.0`.\n- Look for workflows containing condition steps with a webhook URL set to private or link-local addresses such as `169.254.169.254`.\n- Confirm whether untrusted users can create or edit workflows in your Novu instance.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-3.15.0-or-later","no-condition-webhooks"],"who_is_affected":"Teams running Novu, or building on @novu/api, where users can configure workflow condition webhooks. The flaw lets a workflow author reach internal services and metadata endpoints from the server, so self-hosted deployments on cloud infrastructure carry the most risk. Deployments that only use trusted workflow authors and block egress to internal addresses carry less.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00086,"input_tokens":5425,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125114':13A,21A '-2026':12A,20A '-918':28B '/12':201C '/16':203C,205C '/8':197C,199C '/execution-details':306C '/latest/meta-data/iam/security-credentials':240C '1':223C '10.0.0.0':198C '127.0.0.0':196C '130':177C '169.254.0.0':204C '169.254.169.254':239C '172.16.0.0':200C '192.168.0.0':202C '2':231C '261':94C,140C '3':241C '4':250C '4x48':16A '5':263C 'accept':327C,334C 'access':273C 'address':70B 'also':337C 'api':85B,278C,307C 'appli':57B,214C 'attack':59B 'aw':325C 'await':143C,181C,358C,373C 'axios.post':105C,144C,258C,352C,374C 'azur':321C 'block':123C,186C,368C 'bodi':286C 'bypass':8A 'call':157C,257C,348C 'caus':137C 'cgf9':17A 'check':192C 'child.webhookurl':145C,360C,375C 'cloud':25B,73B 'cloud-metadata':24B 'code':172C 'codebas':118C,210C 'come':162C 'concept':222C 'condit':5A,36B,88C,128C,166C,217C,229C,234C,255C,294C 'conditions-filter.usecase.ts':138C,354C 'config':147C,377C 'configur':45B,101C,167C,232C 'const':179C,356C 'contrast':174C 'correct':119C 'creat':62B,224C 'credenti':331C 'cve':11A,19A 'cwe':27B 'data':80B,266C,310C 'detail':84B,271C,277C,301C 'dns':190C 'endpoint':75B,262C,317C 'error':365C 'evalu':253C,295C 'event':249C 'execut':83B,270C,276C,300C 'execute-http-request-step.usecase.ts':175C 'exist':207C 'extract':341C 'field':303C 'filter':6A,37B,89C 'fix':340C 'full':281C 'full-read':280C 'function':188C 'gcp':318C 'get':305C,320C,323C 'ghsa':15A 'ghsa-4x48-cgf9-q33f':14A 'host':33B 'http':53B,111C 'imdsv1':326C 'impact':279C 'includ':132C 'intern':69B,332C 'ip':125C 'libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts':92C 'limit':314C 'line':93C,139C,176C 'make':65B 'metadata':26B,74B,261C,316C 'method':313C 'new':364C 'notif':248C 'novu':1A,29B,34B 'novu/api':22A,23B 'packag':30B 'path':219C 'payload':146C,376C 'post':40B,96C,312C,328C,335C 'privat':124C,194C 'proof':220C 'protect':10A,135C,171C,371C 'q33f':18A 'rang':126C,195C 'raw':104C,302C 'reach':68B 'reachabl':338C 'read':77B,282C 'record':153C,290C 'request':41B,54B,97C,112C 'requir':319C,322C 'resolv':189C 'respons':79B,149C,265C,285C 'response.data':151C 'return':142C,150C,288C,308C,330C,372C 'root':136C 'self':32B 'self-host':31B 'send':39B,95C,246C 'server':67B 'servic':333C 'share':345C 'ssrf':3A,49B,108C,283C,370C 'ssrferror':357C,362C 'ssrfvalidationerror':180C,185C 'step':56B,114C,230C 'store':268C,297C 'string':154C,291C 'suggest':339C 'summari':86C 'throw':363C 'trigger':242C 'typescript':141C,178C,355C 'unknown':155C,292C 'url':46B,102C,183C,237C,367C 'use':103C,120C 'user':44B,100C 'user-configur':43B,99C 'util':346C 'valid':50B,109C,170C 'validateurlssrf':9A,121C,159C,182C,342C,359C 'via':4A,274C 'webhook':7A,38B,90C,129C,218C,236C,366C 'webhookurl':161C 'without':47B 'worker':252C 'workflow':55B,63B,113C,165C,226C,244C 'zero':169C","nicknames":[],"mitigations":[],"who_affected":"Teams running Novu, or building on @novu/api, where users can configure workflow condition webhooks. The flaw lets a workflow author reach internal services and metadata endpoints from the server, so self-hosted deployments on cloud infrastructure carry the most risk. Deployments that only use trusted workflow authors and block egress to internal addresses carry less.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["api"],"ptokens":["api","novu"],"labels":["api","cloudmetadata","cwe918","high","novu","npm","package","selfhosted"],"campaign_type":null,"search_a":"'-125114':13A,21A '-2026':12A,20A '4x48':16A 'bypass':8A 'cgf9':17A 'condit':5A 'cve':11A,19A 'filter':6A 'ghsa':15A 'ghsa-4x48-cgf9-q33f':14A 'novu':1A 'novu/api':22A 'protect':10A 'q33f':18A 'ssrf':3A 'validateurlssrf':9A 'via':4A 'webhook':7A","search_b":"'-918':28B 'address':70B 'api':85B 'appli':57B 'attack':59B 'cloud':25B,73B 'cloud-metadata':24B 'condit':36B 'configur':45B 'creat':62B 'cwe':27B 'data':80B 'detail':84B 'endpoint':75B 'execut':83B 'filter':37B 'host':33B 'http':53B 'intern':69B 'make':65B 'metadata':26B,74B 'novu':29B,34B 'novu/api':23B 'packag':30B 'post':40B 'reach':68B 'read':77B 'request':41B,54B 'respons':79B 'self':32B 'self-host':31B 'send':39B 'server':67B 'ssrf':49B 'step':56B 'url':46B 'user':44B 'user-configur':43B 'valid':50B 'webhook':38B 'without':47B 'workflow':55B,63B","search_c":"'/12':201C '/16':203C,205C '/8':197C,199C '/execution-details':306C '/latest/meta-data/iam/security-credentials':240C '1':223C '10.0.0.0':198C '127.0.0.0':196C '130':177C '169.254.0.0':204C '169.254.169.254':239C '172.16.0.0':200C '192.168.0.0':202C '2':231C '261':94C,140C '3':241C '4':250C '5':263C 'accept':327C,334C 'access':273C 'also':337C 'api':278C,307C 'appli':214C 'aw':325C 'await':143C,181C,358C,373C 'axios.post':105C,144C,258C,352C,374C 'azur':321C 'block':123C,186C,368C 'bodi':286C 'call':157C,257C,348C 'caus':137C 'check':192C 'child.webhookurl':145C,360C,375C 'code':172C 'codebas':118C,210C 'come':162C 'concept':222C 'condit':88C,128C,166C,217C,229C,234C,255C,294C 'conditions-filter.usecase.ts':138C,354C 'config':147C,377C 'configur':101C,167C,232C 'const':179C,356C 'contrast':174C 'correct':119C 'creat':224C 'credenti':331C 'data':266C,310C 'detail':271C,277C,301C 'dns':190C 'endpoint':262C,317C 'error':365C 'evalu':253C,295C 'event':249C 'execut':270C,276C,300C 'execute-http-request-step.usecase.ts':175C 'exist':207C 'extract':341C 'field':303C 'filter':89C 'fix':340C 'full':281C 'full-read':280C 'function':188C 'gcp':318C 'get':305C,320C,323C 'http':111C 'imdsv1':326C 'impact':279C 'includ':132C 'intern':332C 'ip':125C 'libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts':92C 'limit':314C 'line':93C,139C,176C 'metadata':261C,316C 'method':313C 'new':364C 'notif':248C 'path':219C 'payload':146C,376C 'post':96C,312C,328C,335C 'privat':124C,194C 'proof':220C 'protect':135C,171C,371C 'rang':126C,195C 'raw':104C,302C 'reachabl':338C 'read':282C 'record':153C,290C 'request':97C,112C 'requir':319C,322C 'resolv':189C 'respons':149C,265C,285C 'response.data':151C 'return':142C,150C,288C,308C,330C,372C 'root':136C 'send':95C,246C 'servic':333C 'share':345C 'ssrf':108C,283C,370C 'ssrferror':357C,362C 'ssrfvalidationerror':180C,185C 'step':114C,230C 'store':268C,297C 'string':154C,291C 'suggest':339C 'summari':86C 'throw':363C 'trigger':242C 'typescript':141C,178C,355C 'unknown':155C,292C 'url':102C,183C,237C,367C 'use':103C,120C 'user':100C 'user-configur':99C 'util':346C 'valid':109C,170C 'validateurlssrf':121C,159C,182C,342C,359C 'via':274C 'webhook':90C,129C,218C,236C,366C 'webhookurl':161C 'worker':252C 'workflow':113C,165C,226C,244C 'zero':169C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-04-14T23:22:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4x48-cgf9-q33f","url":"https://github.com/advisories/GHSA-4x48-cgf9-q33f","severity":"high","published_at":"2026-04-14T23:22:48+00:00","modified_at":"2026-11-09T22:15:04+00:00","first_seen_at":"2026-11-09T22:15:29+00:00","fetched_at":"2026-11-09T22:20:40+00:00","note":null}],"documents":[{"id":110229,"url":"https://api.github.com/repos/novuhq/novu/security-advisories/GHSA-4x48-cgf9-q33f","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110230,"url":"https://github.com/novuhq/novu/security/advisories/GHSA-4x48-cgf9-q33f","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110231,"url":"https://github.com/novuhq/novu/commit/87d965eb88340ac7cd262dd52c8015acd092dc68","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}