CVE-2026-22664 f CVE debrief

Who should care

Organizations operating prompts.chat instances, security teams managing AI/ML application infrastructure, developers implementing third-party API integrations with polling mechanisms, and Fal.ai customers concerned about API key exposure

Technical summary

The prompts.chat application implements a media status polling feature that communicates with Fal.ai services. The polling mechanism accepts a token parameter that is used to construct or directly specify the target URL for status checks. The application performs no validation of this URL before executing the HTTP request, permitting attackers to supply arbitrary URLs including internal network addresses or attacker-controlled endpoints. When the application makes these requests, it includes the FAL_API_KEY in the Authorization header, which is then transmitted to the attacker-specified destination. This enables credential exfiltration, lateral movement through internal network probing, and financial/resource abuse of the victim's Fal.ai account. The vulnerability requires authenticated access but is otherwise trivial to exploit given the lack of URL validation controls.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade to prompts.chat commit 30a8f04 or later which implements proper URL validation for Fal.ai media status polling endpoints
• Implement strict allowlist validation for all outbound HTTP requests in media polling features, restricting destinations to known-good Fal.ai API endpoints
• Review application logs for anomalous outbound requests from the media status polling feature, particularly requests to unexpected internal or external destinations
• Rotate exposed FAL_API_KEY credentials if compromise is suspected
• Deploy network egress controls to restrict server-initiated connections to authorized Fal.ai infrastructure only
• Audit similar polling or webhook mechanisms in the application for equivalent SSRF vulnerabilities

Evidence notes

The vulnerability was disclosed via VulnCheck and NVD with CVSS 4.0 vector indicating network attack vector, low attack complexity, low privileges required, and high confidentiality impact. The weakness is classified as CWE-918 (Server-Side Request Forgery). A patch commit (30a8f0470e0ba45e6be9c9f55220f4a9a6b91c99) addresses the issue. The exploitability is confirmed through third-party advisory and exploit demonstration.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.