Live › vulnerability › CVE-2026-111663
Go to dashboardChaskiq through 2.0.3 (latest release) has an SSRF in the createUrlUpload GraphQL mutation. It does no authorization and calls URI.parse(url).open on a caller-supplied URL, with no filtering of loopback, private or metadata addresses. It stores the body as an ActiveStorage blob and returns the blob path, so the caller reads the full response, for example cloud instance-metadata credentials. The finder says the messenger endpoint /api/graphql needs only the public app key from the widget snippet, sent in the APP header. The CVE text says POST /graphql. No fixed version is published. The default branch is also affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| chaskiq | vendor | <= 2.0.3 | – |
2.0.3 or earlier, or a build of the main branch? You are affected, and there is no config toggle169.254.169.254, 127.0.0.1, RFC1918)2.0.3 is the latest)169.254.169.254 and private ranges from the app host; remove the createUrlUpload field from app/graphql/types/mutation_type.rbEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-111663")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.