CVE-2026-111663 chaskiq CVE debrief

Who should care

Defenders and administrators of Chaskiq instances should assess exposure and prioritize remediation due to the critical severity of this vulnerability. Operators, platform administrators, and security teams should review official advisories, verify affected scope, and plan vendor-supported updates or mitigations. Security teams should also monitor for suspicious activity and update incident response plans accordingly.

Why it matters

CVE-2026-111663 is a critical SSRF vulnerability in Chaskiq through 2.0.3 that allows unauthenticated attackers to fetch arbitrary URLs. Defenders and administrators of Chaskiq instances should assess exposure and prioritize remediation due to the critical severity of this vulnerability.

• Potential unauthorized access to internal resources
• Possible data breaches through metadata endpoint exposure
• Required verification of affected versions and remediation status
• Potential impact on cloud instance security

Technical summary

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL. This vulnerability has a high impact on cloud instance security and requires verification of affected versions and remediation status. Defenders should review official advisories and implement additional security measures to detect and prevent SSRF attacks.

Defensive priority

High

Recommended defensive actions

• Review and update Chaskiq to a version beyond 2.0.3 if available
• Restrict access to the GraphQL API to authenticated users only
• Implement additional security measures to detect and prevent SSRF attacks
• Monitor for suspicious activity and update incident response plans accordingly
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the SSRF vulnerability in Chaskiq through 2.0.3. Limited information is available on potential exploitation or impact. Defenders should verify affected versions, review official advisories, and monitor for suspicious activity. The CVE Program and NVD records provide source-grounded information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.