CVE-2026-111662: Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
Affected Software
Event History
Frequently Asked Questions
Which systems are most at risk from this issue?
Chaskiq instances through 2.0.3 that expose the /oembed endpoint are susceptible because exploitation is unauthenticated. The primary exposure is to resources reachable from the Chaskiq server itself, including loopback services, private-network hosts, and cloud metadata endpoints.
What does an attacker need to exploit the vulnerability?
An attacker only needs network access to the affected Chaskiq /oembed endpoint and can supply a target through its url parameter. No authentication or user interaction is required.
What information can an attacker obtain through the SSRF?
The vulnerable link-card fetching behavior can read page titles and descriptions from targeted internal resources. The available data does not indicate that arbitrary response bodies are disclosed.
Why can redirect and TLS behavior increase the impact?
FetchLinkCardService follows redirects and does not verify TLS certificates. This can allow an attacker to redirect requests toward internal targets and reach HTTPS services even when their certificates are not trusted.