{"id":"CVE-2026-111663","kind":"vulnerability","aliases":["CVE-2026-111663"],"related":[],"title":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…","description":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.","summary":"Chaskiq through 2.0.3 (latest release) has an SSRF in the createUrlUpload GraphQL mutation. It does no authorization and calls URI.parse(url).open on a caller-supplied URL, with no filtering of loopback, private or metadata addresses. It stores the body as an ActiveStorage blob and returns the blob path, so the caller reads the full response, for example cloud instance-metadata credentials. The finder says the messenger endpoint /api/graphql needs only the public app key from the widget snippet, sent in the APP header. The CVE text says POST /graphql. No fixed version is published. The default branch is also affected.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"chaskiq","fixed":[],"affected":"<= 2.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["chaskiq","cloud","cloud-metadata","graphql","package","rails","self-hosted","ssrf"],"not_affected_if":["managed-hosting","version-above-2.0.3"],"how_to_check":"Run Chaskiq 2.0.3 or earlier, or a build of the main branch? You are affected, and there is no config toggle. Look for the mutation in your checkout: grep -rn createUrlUpload app/graphql. Check access logs for POST /graphql or /api/graphql whose body contains createUrlUpload, and look for ActiveStorage blobs created from internal URLs (169.254.169.254, 127.0.0.1, RFC1918). Also check outbound requests from the app host to metadata addresses.","fix":"No patched release exists as of 2026-10-23 (2.0.3 is the latest). Mitigate: block POST requests whose body contains createUrlUpload at the proxy/WAF; require IMDSv2 with hop limit 1 or block egress to 169.254.169.254 and private ranges from the app host; remove the createUrlUpload field from app/graphql/types/mutation_type.rb. If you suspect abuse, rotate the instance role credentials and any secrets reachable from internal services. Watch github.com/chaskiq/chaskiq for a fix.","status":"open","published_at":"2026-10-16T18:17:48+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:09:07+00:00","updated_at":"2026-10-23T23:31:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:09:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"Chaskiq through version 2.0.3 has a server-side request forgery flaw in its createUrlUpload GraphQL mutation. An unauthenticated attacker can make the server fetch internal URLs, including cloud metadata endpoints, and read the response back through an ActiveStorage blob URL.","category":"package","who_cares":["chaskiq","self-hosted","cloud"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads cloud metadata credentials and internal service responses","analyst_note":"Check NVD and the Chaskiq repository for the patched version and whether the createUrlUpload mutation is exposed by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-above-2.0.3"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000444,"input_tokens":2792,"output_tokens":329,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check NVD and the Chaskiq repository for the patched version and whether the createUrlUpload mutation is exposed by default.","search":"'-111663':18A,21A '-2026':17A,20A '/api/graphql':105B '/graphql':126B,174C '2.0.3':3A,37B,140C 'activestorag':78B,183C 'address':71B 'affect':137B 'allow':13A,150C 'also':136B 'app':110B,119B 'arbitrari':155C 'attack':15A,152C,162C 'author':51B 'blob':79B,83B,184C 'bodi':75B 'branch':134B 'call':53B 'caller':60B,87B 'caller-suppli':59B 'chaskiq':1A,22A,23B,35B,138C 'cloud':24B,26B,94B,168C 'cloud-metadata':25B 'contain':4A,141C 'createurlupload':45B,159C 'credenti':98B 'cve':16A,19A,122B 'default':133B 'endpoint':104B,171C 'exampl':93B 'fetch':154C 'filter':65B 'finder':100B 'fix':128B 'forgeri':10A,147C 'full':90B,178C 'graphql':28B,46B,160C 'header':120B 'host':33B 'includ':167C 'instanc':96B,169C 'instance-metadata':95B 'intern':165C 'key':111B 'latest':38B 'loopback':67B 'messeng':103B 'metadata':27B,70B,97B,170C 'mutat':47B,161C 'need':106B 'open':56B 'packag':29B 'path':84B 'post':125B,173C 'privat':68B 'public':109B 'publish':131B 'rail':30B 'read':88B 'releas':39B 'request':9A,146C 'respons':91B,179C 'retriev':176C 'return':81B,182C 'say':101B,124B 'self':32B 'self-host':31B 'sent':116B 'server':7A,144C 'server-sid':6A,143C 'side':8A,145C 'snippet':115B 'ssrf':34B,42B 'store':73B 'submit':164C 'suppli':61B 'text':123B 'unauthent':14A,151C 'uri.parse':54B 'url':55B,62B,156C,166C,185C 'version':129B 'via':157C,180C 'vulner':11A,148C 'widget':114B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111663","severity":null,"published_at":"2026-10-16T18:17:48+00:00","modified_at":"2026-10-23T16:16:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111663:458","url":null,"severity":null,"published_at":"2026-10-23T23:31:01+00:00","modified_at":"2026-10-23T23:31:01+00:00","first_seen_at":"2026-10-23T23:31:01+00:00","fetched_at":"2026-10-23T23:31:01+00:00","note":"Primary source is the finder's write-up (hackmd, static source review of 2.0.3); VulnCheck is the CNA. No vendor advisory or fixed release found: 2.0.3 is the latest release and the write-up says the default branch is also affected. No exploitation reported; no working PoC, only illustrative requests. A sibling CVE-2026-111662 covers the /oembed endpoint, same product."}],"documents":[{"id":2012,"url":"https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload","title":"Chaskiq SSRF in oembed endpoint and createUrlUpload mutation (hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2013,"url":"https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb","title":"create_url_upload.rb at 2.0.3","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2015,"url":"https://github.com/chaskiq/chaskiq/releases","title":"chaskiq releases (2.0.3 latest)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2017,"url":"https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation","title":"VulnCheck advisory CVE-2026-111663","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}