Key points
- CVE-2026-111663 is rated CVSS 9.2 Critical by the National Vulnerability Database.
- The flaw affects Chaskiq through version 2.0.3 and requires no authentication.
- Attackers can exploit the createUrlUpload GraphQL mutation to fetch internal URLs.
Chaskiq versions up to 2.0.3 contain a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs. The National Vulnerability Database assigns this flaw CVE-2026-111663 and rates it as Critical with a CVSS score of 9.2. This weakness stems from CWE-918, which relates to server-side request forgery issues in web applications.
Attackers can submit internal URLs, including cloud instance metadata endpoints, through the POST /graphql endpoint. The application then retrieves the full response and returns it via an ActiveStorage blob URL. This mechanism allows an attacker to access sensitive internal data without needing valid credentials or user sessions. The vulnerability exists in the createUrlUpload GraphQL mutation specifically.
Technical Context
The vulnerability is classified under CWE-918, indicating a failure to properly validate user-supplied URLs. The NVD record highlights that the createUrlUpload mutation processes these requests without sufficient security checks. This allows the server to act as a proxy for internal network requests. The returned data is accessible through a generated blob URL, facilitating data exfiltration.
Affected Environments
Any deployment of Chaskiq up to version 2.0.3 is affected by this issue. Organizations using this customer engagement platform must verify their current version immediately. The flaw is present in the software code itself, meaning all installations of these versions are potentially vulnerable. No specific configuration mitigates this risk according to the source material.
Next steps
Administrators should audit their Chaskiq installations to determine if they are running version 2.0.3 or earlier. If the software is affected, teams should monitor for unusual GraphQL activity. Since no patch is confirmed in the source material, isolation of exposed instances may be necessary. Review access logs for any unauthorized URL fetching attempts.
Signals worth monitoring
Teams usually detect server-side request forgery by reviewing web server logs for unusual outbound connections. Check whether the application is making requests to internal IP ranges or metadata services. Look for GraphQL mutations that result in unexpected data retrieval or large response sizes. Monitor for ActiveStorage blob URLs being accessed by unauthenticated sources. Alert on any POST requests to the GraphQL endpoint that do not originate from known user agents. Investigate spikes in network traffic from the application server to internal resources.
What to do and how to stay safe: Chaskiq
- Verify the installed version of Chaskiq and compare it against the affected range up to 2.0.3.
- Restrict outbound network traffic from the application server to prevent access to internal metadata endpoints.
- Monitor GraphQL endpoint logs for unauthorized or unusual createUrlUpload mutation attempts.
- Isolate affected instances from the internet until a vendor update is available and tested.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111663?
The National Vulnerability Database rates this vulnerability as Critical with a CVSS score of 9.2.
Which versions of Chaskiq are affected?
Chaskiq versions up to and including 2.0.3 are affected by this server-side request forgery vulnerability.
How can attackers exploit this flaw?
Attackers can submit internal URLs via the createUrlUpload GraphQL mutation to fetch and retrieve internal data.
