CVE-2026-75511

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through send-message-chat.usecase.ts to raw HTTP requests in the Slack, Discord, Mattermost, Microsoft Teams, Grafana On-Call, Ryver, Rocket.Chat, GetStream, and Zulip providers. An authenticated user can supply an internal or otherwise restricted destination because these paths do not apply normalizeOutboundHttpUrl, assertSafeOutboundUrl, or the DNS-pinned safeOutboundJsonRequest protection used by the generic webhook providers. The Novu worker can consequently issue attacker-directed POST requests to internal network services and cause interactions or actions supported by those services. This issue is fixed in version 3.18.0.

• CWE-918

• https://github.com/novuhq/novu/commit/dabfd66457c0b98ad46a8186e69f74f570a990c2
• https://github.com/novuhq/novu/pull/11455
• https://github.com/novuhq/novu/releases/tag/v3.18.0
• https://github.com/novuhq/novu/security/advisories/GHSA-pg9q-8v57-hqph

Published

Sep 22, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75505EspoCRM is an open source customer relationship management a…6
• CVE-2026-75507GraphQL-core is a Python port of the GraphQL.js reference im…7.5
• CVE-2026-75508GraphQL-core is a Python port of the GraphQL.js reference im…7.5
• CVE-2026-75509joserfc is a Python library that provides an implementation …6.5
• CVE-2026-7551HKUDS OpenHarness contains a remote code execution vulnerabi…8.8
• CVE-2026-75510Novu provides an API for sending notifications through multi…5.1
• CVE-2026-75513Marten is a .NET Transactional Document DB and Event Store o…9.1
• CVE-2026-75514BunkerWeb is an open-source, next-generation Web Application…5.9
• CVE-2026-75516The RabbitMQ Java client library allows Java and JVM-based a…8.7
• CVE-2026-75517Novu provides an API for sending notifications through multi…6.5
• CVE-2026-7552The Geo Mashup plugin for WordPress is vulnerable to authori…5.3
• CVE-2026-75520Domoticz is a free, open source home automation system for L…5.4