CVE-2026-111663
HighCVSS 8.6Summary
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Risk Assessment
An unauthenticated attacker can reach internal services and cloud metadata, potentially leading to credential leakage and cloud infrastructure compromise.
Recommendation
Upgrade Chaskiq beyond 2.0.3 and restrict external URL fetching in the createUrlUpload mutation using allowlists and blocking access to internal network ranges.
Other vulnerabilities in Chaskiq
See all- CVE-2026-111662Medium
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
- CVE-2026-72536High
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers.
- CVE-2026-72535High
A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a customer portal session linked to any tenant Stripe account.
Original NVD description (English source)
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS