{"id":"CVE-2026-111662","kind":"vulnerability","aliases":["CVE-2026-111662"],"related":[],"title":"Chaskiq: unauthenticated SSRF via /oembed exposes internal URLs","description":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.","summary":"Chaskiq through 2.0.3 has a server-side request forgery flaw in its /oembed endpoint, where the url parameter is fetched by the server without restriction. An unauthenticated attacker can make the server request loopback, private network or cloud metadata addresses and read back page titles and descriptions.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chaskiq","cloud","package","self-hosted"],"not_affected_if":["hosted-by-vendor","version-above-2.0.3"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:47+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:42:21+00:00","updated_at":"2026-10-25T03:42:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:42:21Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Chaskiq: unauthenticated SSRF via /oembed exposes internal URLs","impact":"medium","summary":"Chaskiq through 2.0.3 has a server-side request forgery flaw in its /oembed endpoint, where the url parameter is fetched by the server without restriction. An unauthenticated attacker can make the server request loopback, private network or cloud metadata addresses and read back page titles and descriptions.","category":"package","nicknames":[],"who_cares":["chaskiq","self-hosted","cloud"],"confidence":0.6,"needs_auth":"no","worst_case":"Server fetches internal URLs and leaks page titles and descriptions","analyst_note":"Find the fixed version and any vendor advisory for Chaskiq beyond 2.0.3; the NVD entry gives no patch or check command.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["hosted-by-vendor","version-above-2.0.3"],"who_is_affected":"Chaskiq installations up to and including 2.0.3 that expose the /oembed endpoint are affected, since the flaw is reachable without an account. Self-hosted instances on cloud or internal networks are the most exposed, because metadata and internal services can be reached through the server. Teams using a hosted Chaskiq service or a version later than 2.0.3 should confirm with their provider or release notes.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000599,"input_tokens":3358,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111662':11A,14A '-2026':10A,13A '/oembed':5A,34B,97C '2.0.3':23B,71C 'address':61B,108C 'allow':81C 'arbitrari':89C 'attack':49B,83C,99C 'back':64B 'chaskiq':1A,15B,21B,69C 'cloud':16B,59B,106C 'cloud-metadata':105C 'contain':72C 'cve':9A,12A 'descript':68B,124C 'endpoint':35B,98C 'expos':6A 'fetch':41B,88C 'fetchlinkcardservic':110C 'flaw':31B 'follow':112C 'forgeri':30B,78C 'host':20B 'intern':7A,120C 'loopback':55B,102C 'make':51B,85C 'metadata':60B,107C 'network':57B 'packag':17B 'page':65B,121C 'paramet':39B,94C 'privat':56B,103C 'read':63B,119C 'redirect':113C 'request':29B,54B,77C 'restrict':46B 'self':19B 'self-host':18B 'server':27B,44B,53B,75C,87C 'server-sid':26B,74C 'side':28B,76C 'skip':115C 'ssrf':3A 'target':101C 'titl':66B,122C 'tls':116C 'unauthent':2A,48B,82C 'url':8A,38B,90C,93C 'verif':117C 'via':4A,91C 'vulner':79C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Chaskiq installations up to and including 2.0.3 that expose the /oembed endpoint are affected, since the flaw is reachable without an account. Self-hosted instances on cloud or internal networks are the most exposed, because metadata and internal services can be reached through the server. Teams using a hosted Chaskiq service or a version later than 2.0.3 should confirm with their provider or release notes.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111662","severity":null,"published_at":"2026-10-16T18:17:47+00:00","modified_at":"2026-10-16T20:17:21+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}