API Notification Vulnerability in Novu Software

CVE-2026-125114

What is CVE-2026-125114?

Novu's API for sending notifications has a serious flaw that allows user-configured webhook URLs to be processed without adequate validation. Specifically, prior to version 3.15.0, the system did not properly validate the webhook URL before making a POST request to it, potentially allowing for unintended access to internal, private services. This issue can lead to the accidental exposure of sensitive information, such as credentials from internal metadata services, when the execution details are publicly accessible. The vulnerability has been addressed in version 3.15.0, underscoring the importance of validating URLs in API calls to avert unauthorized data leaks.

References