CVE-2026-111323 — RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the in…
Published: 2026-10-15 · CVSS: 6.9 · CVSS 4.0
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7