Live › vulnerability › CVE-2026-111662
Go to dashboardChaskiq through 2.0.3 has a server-side request forgery flaw in its /oembed endpoint, where the url parameter is fetched by the server without restriction. An unauthenticated attacker can make the server request loopback, private network or cloud metadata addresses and read back page titles and descriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Chaskiq installations up to and including 2.0.3 that expose the /oembed endpoint are affected, since the flaw is reachable without an account. Self-hosted instances on cloud or internal networks are the most exposed, because metadata and internal services can be reached through the server. Teams using a hosted Chaskiq service or a version later than 2.0.3 should confirm with their provider or release notes.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
This page as .md · .json · in your agent: get_signal("CVE-2026-111662")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.