Unauthenticated Server-Side Request Forgery in ValueCell by ValueCell-ai

CVE-2026-111320

What is CVE-2026-111320?

ValueCell, up to version 0.1.20, is affected by a server-side request forgery vulnerability that enables remote attackers to manipulate backend requests. By sending specially crafted requests to the provider config endpoint, attackers can set an unvalidated provider base_url. This flaw allows them to trigger the POST request to /api/v1/models/check, accessing sensitive internal and metadata addresses. Successful exploitation can lead to the disclosure of error messages and stored API keys from providers, raising significant concerns regarding data security and privacy.

References