CVE-2026-111323

Received Received - Intake

Unauthenticated SSRF in RedAmon Agent via URL Validation Bypass

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111323

Affected Vendors & Products

Vendor	Product	Version / Range
samugit83	RedAmon	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

RedAmon through version 7.0.1 has an unauthenticated server-side request forgery (SSRF) vulnerability in the agent POST /tradecraft/verify endpoint. The validate_url function only checks the initial hostname, allowing attackers to submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services. This lets attackers receive fetched content through the model-generated summary.

Detection Guidance

Detecting this SSRF vulnerability in RedAmon requires checking for unauthenticated requests to the /tradecraft/verify endpoint with URLs that may redirect or DNS-rebind to internal services. Monitor network traffic for outbound requests from RedAmon to unexpected internal IP ranges or cloud metadata endpoints. Check server logs for POST requests to /tradecraft/verify with public URLs that resolve to internal addresses.

Impact Analysis

This vulnerability allows attackers to access internal network resources by tricking the server into making requests to internal addresses. It could lead to unauthorized data exposure, internal service probing, or further exploitation of internal systems.

Mitigation Strategies

Immediately update RedAmon to the latest version if a patch exists. If not, restrict outbound network access from the RedAmon server to prevent SSRF attacks. Implement strict URL validation in the /tradecraft/verify endpoint to block requests to private or internal IP addresses. Use allowlists for permitted domains and disable redirects in URL validation.

Hi! I’m here to help you understand CVE-2026-111323. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70