Description
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Published: 2026-10-16
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery enabling unauthenticated URL fetches
Action: Patch Immediately
AI Analysis

Impact

Chaskiq through version 2.0.3 contains a server‑side request forgery vulnerability in the createUrlUpload GraphQL mutation. Unauthenticated attackers can submit arbitrary URLs via POST /graphql, causing the server to fetch the content and return the complete response through an ActiveStorage blob URL. This flaw allows attackers to read internal resources, such as cloud instance metadata endpoints, and exfiltrate sensitive network information. The weakness is a classic SSRF, classified under CWE‑918.

Affected Systems

The vulnerability affects the Chaskiq product for all releases up to and including version 2.0.3.

Risk and Exploitability

The CVSS score of 9.2 indicates critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. Attackers can exploit it remotely over the network by crafting a GraphQL request; authentication is not required, making the threat immediate and wide‑ranging for any exposed instance.

Generated by OpenCVE AI on October 16, 2026 at 19:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the newest available Chaskiq release that removes the vulnerable createUrlUpload mutation.
  • If an update is not possible, modify the resolver to reject URLs that target internal network ranges or known metadata service endpoints, and accept only approved external domains.
  • Restrict outbound traffic from the Chaskiq server using firewall rules or network segmentation to block access to internal metadata services and other sensitive intranet endpoints.

Generated by OpenCVE AI on October 16, 2026 at 19:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Chaskiq
Chaskiq chaskiq
Vendors & Products Chaskiq
Chaskiq chaskiq

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Title Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Chaskiq Chaskiq
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T17:39:26.910Z

Reserved: 2026-10-16T14:31:16.640Z

Link: CVE-2026-111663

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:48.077

Modified: 2026-10-16T19:03:18.127

Link: CVE-2026-111663

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T15:30:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)