---
id: CVE-2026-111323
title: RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
summary: >-
  RedAmon through 7.0.1 contains an unauthenticated server-side request forgery
  vulnerability in the agent POST /tradecraft/verify endpoint because
  validate_url checks only the initial hostname. Attackers can submit a public
  URL that redir…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: samugit83
product: RedAmon
affected:
  - RedAmon <= 7.0.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:31.708Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111323'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/redamon-tradecraft-verify-unauth-ssrf'
  - url: >-
      https://github.com/samugit83/redamon/blob/e1dfdff671b7e76d3a002eeba37b01d92cb949e1/agentic/orchestrator_helpers/tradecraft_lookup.py#L231
  - url: >-
      https://github.com/samugit83/redamon/blob/e1dfdff671b7e76d3a002eeba37b01d92cb949e1/agentic/orchestrator_helpers/tradecraft_lookup.py#L539
  - url: >-
      https://github.com/samugit83/redamon/blob/e1dfdff671b7e76d3a002eeba37b01d92cb949e1/agentic/api.py#L1688
  - url: 'https://github.com/samugit83/redamon'
  - url: >-
      https://www.vulncheck.com/advisories/redamon-through-7.0.1-unauthenticated-ssrf-via-tradecraft-verify-endpoint
    label: >-
      VulnCheck Advisory: RedAmon through 7.0.1 Unauthenticated SSRF via
      /tradecraft/verify Endpoint
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.451Z'
---

## Overview

RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.

## Affected

- `RedAmon <= 7.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.