Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary… (CVE-2026-111662)

CVE-2026-111662 describes an SSRF vulnerability in Chaskiq up to version 2.0.3. The issue resides in the /oembed endpoint where the url parameter is not properly validated, allowing unauthenticated attackers to induce the server to fetch arbitrary URLs. The FetchLinkCardService component follows HTTP redirects and does not verify TLS certificates, which can be exploited to access internal network resources including loopback addresses, private IP ranges, and cloud metadata services. This can lead to information disclosure such as reading internal page titles and descriptions.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external resources. This may result in disclosure of sensitive internal information, including metadata from cloud services or internal web pages. The vulnerability does not directly allow code execution or denial of service but can facilitate further attacks by revealing internal network details.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /oembed endpoint if possible and monitor for unusual server-side request activity targeting internal resources.