EUVD-2026-102478
GHSA-8m63-6jcp-c2m9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ValueCell API unauthenticated
-
ExploitSet malicious provider base_url
-
ExecutionTrigger POST /api/v1/models/check
-
ImpactCapture metadata responses and stored provider API keys
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the ValueCell server API and no authentication (PR:N). The attacker must (1) set an attacker-controlled, unvalidated provider base_url via the provider config endpoint, then (2) invoke POST /api/v1/models/check to force the backend request. Meaningful impact is bounded by deployment context: reaching cloud metadata requires the instance to run in an environment exposing a metadata service (e.g. AWS/GCP link-local 169.254.169.254); internal-host probing requires the server to have network paths to those hosts; and stealing provider API keys requires that providers have already been configured with stored credentials. The primary limiting factor is exposure - a ValueCell API not reachable from untrusted networks is not remotely exploitable. |
| Impact | The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9/Medium) describes the most attacker-favorable precondition profile: network reachable, low complexity, no attack requirements, no privileges, and no user interaction - meaning any party able to reach the ValueCell API can attempt exploitation. Vendor-rated impact is modest (VC:L/VI:L/VA:N, no subsequent-system impact), which tempers the Medium score, but the described capability to exfiltrate stored provider API keys is a genuine credential-disclosure concern that arguably warrants a higher confidentiality rating than VC:L. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no explicit POC flag was provided, though a detailed public technical writeup (hackmd) and a VulnCheck advisory enumerate the exact vulnerable endpoints and source lines - this lowers the bar to reproduction even absent a packaged exploit. On balance this is a real, easily-triggered flaw whose practical priority is governed less by difficulty (trivial) than by exposure: the affected product appears to be an obscure early-stage AI project, so widespread opportunistic exploitation is unlikely and risk concentrates on the comparatively few internet-exposed ValueCell deployments, especially those running in cloud environments with reachable metadata services. |
| Exploit ScenarioDerived | An unauthenticated remote attacker reaches an internet-exposed ValueCell instance, sets a provider base_url pointing at an internal service or cloud metadata endpoint (e.g. 169.254.169.254), then issues POST /api/v1/models/check to force the backend to make that request. The returned error responses leak internal/metadata data, and the attacker can also harvest stored provider API keys. A detailed public writeup documents the exact endpoints and code paths, so reproduction is straightforward even though no weaponized exploit is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated server-side request forgery in ValueCell through 0.1.20 lets any party that can reach the server API set an unvalidated provider base_url and then force the backend to issue requests to attacker-chosen destinations via POST /api/v1/models/check, enabling probing of internal hosts and cloud metadata addresses, leakage of error-response content, and potential capture of stored provider API keys. The flaw is CWE-918 and rated 6.9 (Medium) under CVSS 4.0 with AV:N/AC:L/AT:N/PR:N/UI:N, meaning it is network-reachable and requires no authentication or user interaction; it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, although a public technical write-up documents the attack path. Real-world impact is bounded by deployment context: the API must be reachable from an untrusted network, metadata access requires the instance to run where a link-local metadata service is exposed, and provider-key theft requires providers to already be configured with stored credentials, which our independent assessment reflects with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
RemediationAI
No vendor-released patch is identified at time of analysis for ValueCell through 0.1.20, so remediation must start with containment. Restrict network access to the ValueCell API so it is not reachable from untrusted networks - front it with an authenticating reverse proxy or firewall allowlist - since the vulnerability is unauthenticated and only exploitable by parties who can reach the API. Apply egress filtering from the ValueCell server so it cannot initiate connections to link-local 169.254.169.254/16, loopback, and RFC1918 ranges, either by blocking those destinations outright or by enforcing a strict allowlist of legitimate provider endpoints; the trade-off is that internal or self-hosted model providers would break unless their addresses are explicitly permitted. Where AWS is used, enforce IMDSv2 so metadata calls require a session token, accepting that legacy IMDSv1 clients may fail. Rotate and audit all stored provider API keys and any credentials reachable from the ValueCell host, because exploitation can expose secrets already configured in the application. If the models/check workflow is not needed, disable or block POST /api/v1/models/check at the proxy layer; otherwise add server-side validation of provider base_url (scheme allowlist, DNS resolution checks, and rejection of private/link-local targets) as an interim code fix. Monitor logs for outbound requests to metadata or internal addresses as a detection measure, and track the upstream repository and the VulnCheck advisory for a future patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an SSRF (CWE-918) in ValueCell's model-provider configuration flow. The provider config endpoint accepts a user-supplied base_url without validating it against an allowlist or blocking loopback, private, and link-local ranges, and the POST /api/v1/models/check endpoint then performs an outbound request to that URL (see python/valuecell/server/api/routers/models.py lines 216-261 and 569 in the v0.1.20 tree). Because the backend HTTP client follows the attacker-controlled destination, requests can be aimed at internal services, RFC1918 addresses, and cloud metadata endpoints such as 169.254.169.254, and the resulting error responses are reflected back to the caller, turning an apparently blind SSRF into a partially readable one. The affected software is identified by CPE cpe:2.3:a:valuecell-ai:valuecell:*:*:*:*:*:*:*:*, and the vulnerability is reachable without credentials (CVSS vector PR:N, confirmed by both the 4.0 vector and our independent 3.1 assessment AV:N/AC:L/PR:N/UI:N). Our assessment treats the confidentiality impact as high (C:H) because captured responses and stored provider credentials can be exfiltrated once exploitation succeeds, with scope change (S:C) since the compromise crosses from the ValueCell server into adjacent internal or cloud-metadata trust domains; there is no confirmed integrity or availability impact (I:N/A:N).
Know when Valuecell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Unauthenticated network SSRF with no user interaction; it pivots into internal/metadata systems so S:C, and it discloses stored API keys so C:H, with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB