CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation
Unauthenticated attackers can exploit an SSRF vulnerability in Chaskiq to fetch internal URLs and retrieve sensitive data via GraphQL mutations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111663?
CVE-2026-111663 is a critical server-side request forgery vulnerability in chaskiq, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Weakness: CWE-918
Which versions are affected by CVE-2026-111663?
How do I fix CVE-2026-111663?
No fix has been published for CVE-2026-111663 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-111663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111663 exists.
Sources
Also known as GHSA-rggr-4j68-hc5w.