ValueCell up to version 0.1.20 contains an unauthenticated server‑side request forgery flaw. An attacker can modify the provider configuration through an unvalidated provider base_url parameter and then trigger the POST /api/v1/models/check endpoint. The backend will unconditionally issue HTTP requests to the supplied base_url, enabling the attacker to reach internal or metadata services, read error responses, and harvest stored API keys from the provider configuration.

The affected product is ValueCell from ValueCell‑ai. Versions through 0.1.20 are vulnerable; the CVE payload does not specify if later releases contain fixes, so administrators should verify current version status with the vendor.

The CVSS score is 6.9, reflecting moderate severity. The EPSS score of <1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. Because authentication is not required and the flaw accepts arbitrary URLs, exploitation is straightforward and could allow an attacker to access internal network resources or exfiltrate credentials. Administrators should seek a vendor fix or apply mitigations such as disabling the endpoint or enforcing network controls.