---
id: "CVE-2026-111662"
kind: "vulnerability"
aliases: ["CVE-2026-111662"]
title: "Chaskiq: unauthenticated SSRF via /oembed exposes internal URLs"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chaskiq", "cloud", "package", "self-hosted"]
not_affected_if: ["hosted-by-vendor", "version-above-2.0.3"]
published_at: "2026-10-16T18:17:47+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:42:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111662", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Chaskiq: unauthenticated SSRF via /oembed exposes internal URLs

Chaskiq through 2.0.3 has a server-side request forgery flaw in its /oembed endpoint, where the url parameter is fetched by the server without restriction. An unauthenticated attacker can make the server request loopback, private network or cloud metadata addresses and read back page titles and descriptions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111662

## From the sources

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_