CVE-2026-111663 is a high severity (CVSS 8.6) server-side request forgery in Chaskiq through 2.0.3. An unauthenticated GraphQL mutation fetches any URL, including cloud metadata addresses, and returns the response through a blob link. The record names no fixed version, so restrict access and block metadata egress.
What's affected
Chaskiq 2.0.3 and earlier, per the record and VulnCheck. The weakness is in the createUrlUpload mutation served at the GraphQL endpoint. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The scope change in the vector reflects that the server can be used to reach systems beyond the application itself, such as internal services and the instance metadata service of a cloud host.
Scoring note: the record's 8.6 is a CVSS 3.1 base score. VulnCheck's advisory also lists 9.2 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm your Chaskiq version. Review outbound connections from the application host. Requests to link-local metadata addresses or internal ranges that your app has no reason to call deserve a look.
In your logs, look for GraphQL requests that invoke the upload mutation without a signed in session, and for new storage blobs created from URLs you do not recognise.
What to do now
- Find all Chaskiq instances and versions.
- Block outbound traffic from the app host to the cloud metadata address and internal networks it does not need.
- Require the hardened metadata mode your cloud offers, such as IMDSv2 on AWS, so a simple fetch cannot read credentials.
- Rotate cloud credentials attached to the host if you see suspicious fetches.
- Upgrade when a fixed release is confirmed.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-918, server-side request forgery. The server is asked to fetch a URL on the caller's behalf and does not limit where it may go. Because the response is exposed through a stored blob, the caller can read what came back, not just trigger a request.
Cloud metadata endpoints are the classic target, since they can hold temporary credentials for the host's role. That turns a web bug into a cloud access problem. It is not listed in CISA KEV.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is SSRF?
A flaw where an application makes requests to addresses chosen by a user, which can reach services the user could not reach directly.
Does the attacker need an account?
The record says no. The mutation is reachable without authentication.
Sources
Last reviewed: 18 October 2026.
