RedAmon CVE-2026-111323

No authentication is required (PR:N): the POST /tradecraft/verify agent endpoint must simply be network-reachable to the attacker. The core defect is that validate_url only validates the initial hostname, so exploitation requires supplying a public URL that either returns an HTTP redirect to an internal address or uses DNS rebinding to resolve to internal space after the check - standard SSRF bypass techniques, no special product configuration needed. Returned data is delivered through the model-generated summary, so the endpoint's summarization/fetch path must be functioning. The primary limiting factor is reachability of the RedAmon agent API; the headline cloud-metadata impact additionally requires the instance to be deployed where a metadata service (e.g. 169.254.169.254) or other sensitive internal endpoints are reachable from the server, though generic internal-network SSRF applies in any deployment.

This is a genuine but moderate-priority issue, and the signals are internally consistent. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw, which raises urgency, but the impact metrics are deliberately limited: only VC:L (low confidentiality) with VI:N/VA:N and no subsequent-system impact (SC/SI/SA:N), yielding a base score of 6.9 (Medium). This matches a classic read-only SSRF - an attacker can coerce the server to fetch internal resources and read back content, but cannot directly write, destroy, or pivot scope through the CVE as scored. No EPSS score, CISA KEV listing, POC flag, or SSVC decision was supplied in the input, so exploitation-probability and automatability signals are simply absent rather than conflicting. The affected product (RedAmon, an independent open-source agentic project by developer samugit83) has a very small deployment footprint, so despite trivial exploitability the real-world blast radius is narrow. Bottom line: a real, low-friction vulnerability class (unauthenticated SSRF reaching cloud metadata) but confined to a niche product with limited (confidentiality-only) scored impact - prioritize patching for anyone actually running RedAmon, but it is not a broad fleet emergency.

An unauthenticated attacker sends a crafted request to the agent's POST /tradecraft/verify endpoint supplying a public URL that passes the initial hostname check in validate_url, then redirects or DNS-rebinds to an internal address such as a cloud metadata service (e.g. 169.254.169.254). RedAmon fetches the internal resource and returns the retrieved content back to the attacker embedded in the model-generated summary, disclosing internal data or cloud credentials. A technical write-up exists (hackmd), but no weaponized exploit code is confirmed in the provided data.