CVE-2026-111323: RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
RedAmon versions through 7.0.1 are affected where the agent POST /tradecraft/verify endpoint is reachable by an attacker. Because no authentication is required, exposure of that endpoint is the key condition described.
What does an attacker need to exploit it?
An attacker only needs network access to submit a request to /tradecraft/verify. They can provide a public URL that redirects to, or DNS-rebinds toward, an internal address.
What internal resources could be targeted?
The vulnerability can be used to make the server fetch internal addresses, including cloud metadata services. Retrieved content may be exposed through the model-generated summary.
What can be done before a patch is available?
Restrict untrusted access to the agent /tradecraft/verify endpoint. Prevent the service from reaching internal networks and cloud metadata endpoints where feasible, since redirects and DNS rebinding can bypass validation that checks only the initial hostname.