MEDIUM 6.9 NVD
CVE-2026-111323
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url c
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.
References
- https://github.com/samugit83/redamon
- https://github.com/samugit83/redamon/blob/e1dfdff671b7e76d3a002eeba37b01d92cb949e1/agentic
- https://github.com/samugit83/redamon/blob/e1dfdff671b7e76d3a002eeba37b01d92cb949e1/agentic
- https://github.com/samugit83/redamon/blob/e1dfdff671b7e76d3a002eeba37b01d92cb949e1/agentic
- https://hackmd.io/@hieuPenguinnn/redamon-tradecraft-verify-unauth-ssrf
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.