CVE-2026-75511
Received Received - Intake

Remote Code Execution in Novu Notification API

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through send-message-chat.usecase.ts to raw HTTP requests in the Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip providers. An authenticated user can supply an internal or otherwise restricted destination because these paths do not apply normalizeOutboundHttpUrl, assertSafeOutboundUrl, or the DNS-pinned safeOutboundJsonRequest protection used by the generic webhook providers. The Novu worker can consequently issue attacker-directed POST requests to internal network services and cause interactions or actions supported by those services. This issue is fixed in version 3.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-75511
EUVD
EUVD-2026-84536

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
slack slack *
discord discord *
mattermost mattermost *
microsoft teams *
grafana grafana_on_call *
ryver ryver *
rocket_chat rocket_chat *
getstream getstream *
zulip zulip *
novu novu 3.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Novu's chat notification providers. An authenticated user can manipulate webhook URLs in subscriber credentials, channel endpoints, or event triggers to make the server issue HTTP requests to arbitrary internal network addresses. The issue affects multiple chat providers (Slack, Discord, Mattermost, MS Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, Zulip) due to improper validation of user-controlled URLs.

Detection Guidance

To detect this SSRF vulnerability in Novu, monitor outbound HTTP requests from the Novu worker process to internal network addresses or restricted destinations. Check logs for POST requests to private IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or unusual domains. Use network traffic analysis tools like tcpdump or Wireshark to inspect traffic from the Novu server. Verify if the Novu version is below 3.18.0, as this vulnerability is fixed in 3.18.0.

Impact Analysis

An attacker could exploit this to send unauthorized requests to internal services, potentially accessing sensitive data, triggering unintended actions, or causing service disruptions. Since the vulnerability allows requests to internal network addresses, it could lead to data breaches or further network compromise if internal services are vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using Novu may face compliance violations if internal data is exposed due to this SSRF flaw.

Mitigation Strategies

Upgrade Novu to version 3.18.0 or later immediately to apply the SSRF protection fixes. If upgrading is not possible, restrict outbound network access for the Novu worker process using firewall rules to block requests to private IP ranges. Disable or audit chat webhook configurations in subscriber credentials, channel endpoints, and event triggers to ensure no internal or restricted URLs are configured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75511. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart