CVE-2026-111320 ValueCell-ai CVE debrief

Who should care

Defenders responsible for ValueCell deployments, especially those using versions up to 0.1.20, should assess exposure and prioritize verification and potential updates. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and mitigate the risk associated with this vulnerability.

Why it matters

CVE-2026-111320 is a medium-severity vulnerability in ValueCell that allows unauthenticated SSRF, potentially exposing internal addresses and API keys. Defenders should prioritize verification and updates.

• Potential exposure of internal or metadata addresses
• Possible capture of stored provider API keys
• Risk of unauthorized access to sensitive information
• Need for verification of ValueCell deployments and updates

Technical summary

The vulnerability is caused by an unvalidated provider base_url in ValueCell through version 0.1.20, allowing remote attackers to direct backend requests via the /api/v1/models/check endpoint. This enables attackers to potentially expose internal addresses and capture stored provider API keys by manipulating the base_url via the provider config endpoint and triggering a POST request to /api/v1/models/check. Defenders should prioritize verifying exposure of ValueCell deployments and assess the risk of internal or metadata address exposure.

Defensive priority

Defenders should prioritize verifying exposure of ValueCell deployments, especially those using versions up to 0.1.20, and assess the risk of internal or metadata address exposure.

Recommended defensive actions

• Verify ValueCell deployments for exposure, especially those using versions up to 0.1.20
• Assess the risk of internal or metadata address exposure
• Review and update ValueCell to a version beyond 0.1.20 if possible
• Monitor for suspicious activity on the /api/v1/models/check endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and advisories. Defenders should verify ValueCell deployments, especially those using versions up to 0.1.20, and assess the risk of internal or metadata address exposure. Evidence limits suggest focusing on CVE and source item details for validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.