---
id: "CVE-2026-111663"
kind: "vulnerability"
aliases: ["CVE-2026-111663"]
title: "Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to\u2026"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "chaskiq", "fixed": [], "affected": "<= 2.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["chaskiq", "cloud", "cloud-metadata", "graphql", "package", "rails", "self-hosted", "ssrf"]
not_affected_if: ["managed-hosting", "version-above-2.0.3"]
published_at: "2026-10-16T18:17:48+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111663", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:31:01+00:00"}]
---

# Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…

Chaskiq through 2.0.3 (latest release) has an SSRF in the createUrlUpload GraphQL mutation. It does no authorization and calls URI.parse(url).open on a caller-supplied URL, with no filtering of loopback, private or metadata addresses. It stores the body as an ActiveStorage blob and returns the blob path, so the caller reads the full response, for example cloud instance-metadata credentials. The finder says the messenger endpoint /api/graphql needs only the public app key from the widget snippet, sent in the APP header. The CVE text says POST /graphql. No fixed version is published. The default branch is also affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:chaskiq affected <= 2.0.3 fixed ?

## How to check

Run Chaskiq 2.0.3 or earlier, or a build of the main branch? You are affected, and there is no config toggle. Look for the mutation in your checkout: grep -rn createUrlUpload app/graphql. Check access logs for POST /graphql or /api/graphql whose body contains createUrlUpload, and look for ActiveStorage blobs created from internal URLs (169.254.169.254, 127.0.0.1, RFC1918). Also check outbound requests from the app host to metadata addresses.

## Fix

No patched release exists as of 2026-10-23 (2.0.3 is the latest). Mitigate: block POST requests whose body contains createUrlUpload at the proxy/WAF; require IMDSv2 with hop limit 1 or block egress to 169.254.169.254 and private ranges from the app host; remove the createUrlUpload field from app/graphql/types/mutation_type.rb. If you suspect abuse, rotate the instance role credentials and any secrets reachable from internal services. Watch github.com/chaskiq/chaskiq for a fix.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111663
- 2026-10-23T23:31:01+00:00 analyst — Primary source is the finder's write-up (hackmd, static source review of 2.0.3); VulnCheck is the CNA. No vendor advisory or fixed release found: 2.0.3 is the latest release and the write-up says the default branch is also affected. No exploitation reported; no working PoC, only illustrative requests. A sibling CVE-2026-111662 covers the /oembed endpoint, same product.

## Documents

- [advisory] Chaskiq SSRF in oembed endpoint and createUrlUpload mutation (hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload
- [advisory] VulnCheck advisory CVE-2026-111663 https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation
- [describes] create_url_upload.rb at 2.0.3 https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb
- [mentions] chaskiq releases (2.0.3 latest) https://github.com/chaskiq/chaskiq/releases

## From the sources

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_