# ValueCell: anyone can repoint the model provider and read the reply

> Two unauthenticated endpoints in ValueCell let a stranger choose where the server sends its model-provider requests.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-15
- **CVE:** CVE-2026-111320
- **CVSS:** 6.9
- **Affects:** ValueCell
- **Research by:** [hieuPenguinnn](https://github.com/hieuPenguinnn)
- **Primary source:** https://www.vulncheck.com/advisories/valuecell-through-0.1.20-unauthenticated-ssrf-via-api-v1-models-check
- **Page:** https://theinjection.dev/items/valuecell-models-check-unauth-ssrf/

CVE-2026-111320 lets an unauthenticated caller set the OpenAI-compatible provider base URL in ValueCell through 0.1.20, then use POST /api/v1/models/check to make the server request internal addresses and return part of the response.

## What happened

VulnCheck published CVE-2026-111320 for ValueCell on October 15, 2026, and the GitHub Advisory Database picked it up the next day. The finder, who writes as hieuPenguinnn, documented the flaw in a HackMD write-up against the project's default branch and states that no tagged release was reviewed and that no PoC was run. VulnCheck lists every version through 0.1.20 as affected and names no fixed release.

## How it works

ValueCell's models router exposes PUT /api/v1/models/providers/openai-compatible/config, which stores a provider base URL without validating its scheme or target, and POST /api/v1/models/check, which makes the server POST to whatever URL was stored. Neither endpoint requires authentication, and the openai-compatible provider is enabled by default. On a non-2xx reply the upstream body is returned in the error field, so the caller reads part of what the server saw, which turns the pair into a map of internal reachability. The write-up adds that the service allows all CORS origins.

## Who is affected

ValueCell, a community multi-agent platform for financial research and trading, is affected in every version through 0.1.20. Exposure depends on who can reach the server: a network-reachable install answers anyone, and even a loopback-only install can be driven by a page the operator visits, because of the wildcard CORS policy. VulnCheck's advisory states that an attacker can also capture stored provider API keys; the write-up does not demonstrate that and says reaching credentials through a metadata service depends on the host environment.

## What to do

Keep ValueCell off untrusted networks until a fix ships, because VulnCheck names no patched version. Put authentication in front of the server, block its outbound requests to loopback, private and link-local addresses, and rotate the model provider keys held in its config if the server was reachable.

## Quick facts

- **CVE:** CVE-2026-111320
- **CVSS 4.0:** 6.9 (VulnCheck)
- **Affected:** ValueCell through 0.1.20
- **Fixed in:** No patched version named
- **Attack type:** Unauthenticated SSRF through the provider config endpoint
- **Found by:** hieuPenguinnn
- **Disclosed:** October 15, 2026

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/valuecell-through-0.1.20-unauthenticated-ssrf-via-api-v1-models-check)
2. [Researcher Write-Up](https://hackmd.io/@hieuPenguinnn/valuecell-model-provider-check-unauth-ssrf)
3. [GitHub Advisory](https://github.com/advisories/GHSA-8m63-6jcp-c2m9)
4. [ValueCell Repo](https://github.com/ValueCell-ai/valuecell)