CVE-2026-111320 — ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated …
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7