ValueCell: anyone can repoint the model provider and read the reply
Two unauthenticated endpoints in ValueCell let a stranger choose where the server sends its model-provider requests.
· VulnCheck · Research by hieuPenguinnn
CVE-2026-111320 lets an unauthenticated caller set the OpenAI-compatible provider base URL in ValueCell through 0.1.20, then use POST /api/v1/models/check to make the server request internal addresses and return part of the response.
01What happened
VulnCheck published CVE-2026-111320 for ValueCell on October 15, 2026, and the GitHub Advisory Database picked it up the next day. The finder, who writes as hieuPenguinnn, documented the flaw in a HackMD write-up against the project's default branch and states that no tagged release was reviewed and that no PoC was run. VulnCheck lists every version through 0.1.20 as affected and names no fixed release.
02How it works
ValueCell's models router exposes PUT /api/v1/models/providers/openai-compatible/config, which stores a provider base URL without validating its scheme or target, and POST /api/v1/models/check, which makes the server POST to whatever URL was stored. Neither endpoint requires authentication, and the openai-compatible provider is enabled by default. On a non-2xx reply the upstream body is returned in the error field, so the caller reads part of what the server saw, which turns the pair into a map of internal reachability. The write-up adds that the service allows all CORS origins.
03Who is affected
ValueCell, a community multi-agent platform for financial research and trading, is affected in every version through 0.1.20. Exposure depends on who can reach the server: a network-reachable install answers anyone, and even a loopback-only install can be driven by a page the operator visits, because of the wildcard CORS policy. VulnCheck's advisory states that an attacker can also capture stored provider API keys; the write-up does not demonstrate that and says reaching credentials through a metadata service depends on the host environment.
04What to do
Keep ValueCell off untrusted networks until a fix ships, because VulnCheck names no patched version. Put authentication in front of the server, block its outbound requests to loopback, private and link-local addresses, and rotate the model provider keys held in its config if the server was reachable.
Sources 4 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2hackmd.ioResearcher Write-Up
- 3github.comGitHub Advisory
- 4github.comValueCell Repo