CVE-2026-111323 Details

A server-side request forgery (SSRF) vulnerability has been identified in RedAmon versions through 7.0.1. The issue resides in the agent's POST /tradecraft/verify endpoint, which lacks authentication. The vulnerability arises because the validate_url function only checks the initial hostname, allowing attackers to submit public URLs that redirect or use DNS rebinding to access internal addresses, such as cloud metadata services. The fetched content is then relayed back through a model-generated summary, effectively exfiltrating sensitive information. This vulnerability is particularly concerning in cloud environments, where it can lead to the exposure of instance metadata and credentials.

The vulnerability can be addressed by implementing proper authentication on the agent's REST surface, validating each redirect hop against public address criteria, and restricting the tradecraft verification route to authenticated users.