CVE-2026-111663
8.6HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-918
Impact
Unauthenticated attackers can access internal network services and cloud metadata by sending requests to the GraphQL endpoint. They need network access to Chaskiq's /graphql endpoint.
Root cause
The createUrlUpload GraphQL mutation fetches user-supplied URLs and stores the responses in ActiveStorage blobs without validating or restricting internal destination addresses.
Affected systems
Chaskiq through 2.0.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
No fixed version is specified in the advisory; check the vendor repository for patches. As an immediate mitigation, block access to the cloud metadata service (169.254.169.254) from the Chaskiq host and restrict or filter the createUrlUpload mutation at your reverse proxy or WAF.
$ iptables -A OUTPUT -d 169.254.169.254 -j DROPAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
References
- https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb#L3-L33
- https://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb#L29-L66
- https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-upload
- https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation