Unauthenticated Server-Side Request Forgery in RedAmon by Samugit

CVE-2026-111323

What is CVE-2026-111323?

RedAmon versions up to 7.0.1 are susceptible to an unauthenticated server-side request forgery vulnerability in the '/tradecraft/verify' endpoint. The vulnerability arises because the validation of URLs performed by the system only checks the initial hostname, allowing malicious actors to manipulate requests by submitting public URLs that can redirect or utilize DNS rebinding techniques to access internal resources such as cloud metadata services. This exploitation can enable attackers to receive sensitive data through the content fetched by the system, posing a significant security risk.

References