CVE-2026-111662
Received Received - Intake

Server-Side Request Forgery in Chaskiq via FetchLinkCardService

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111662
EUVD
EUVD-2026-103084

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
chaskiq chaskiq 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111662 is a server-side request forgery (SSRF) vulnerability in Chaskiq through version 2.0.3. It allows unauthenticated attackers to make the server fetch arbitrary URLs via the /oembed endpoint or a GraphQL mutation. The server follows redirects, skips TLS verification, and returns metadata or full response bodies from internal services, including loopback, private, or cloud-metadata addresses.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual outbound requests from the Chaskiq server, especially to internal or private IP addresses. Check logs for repeated requests to the /oembed endpoint with arbitrary URLs. Use tools like curl to test the endpoint: curl -v 'http://<chaskiq-server>/oembed?url=http://<target-ip>' to see if it returns metadata from internal services.

Impact Analysis

Attackers could exploit this to read internal page titles, descriptions, or full response bodies from private network resources. This may expose sensitive data like cloud metadata, internal APIs, or other confidential information. The GraphQL mutation allows downloading full responses, increasing the risk of data leakage.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to data breaches.

Mitigation Strategies

Immediately upgrade Chaskiq to a patched version beyond 2.0.3. If upgrading is not possible, restrict access to the /oembed endpoint and /api/graphql mutation. Block non-HTTP(S) URLs and private IP addresses in the URL validation. Disable redirect following and re-enable TLS verification in FetchLinkCardService. Add authentication to the GraphQL mutation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111662. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart