Can Unauthenticated GraphQL Mutations in Chaskiq 2.0.3 Steal Cloud Metadata?

A critical security flaw in the Chaskiq open-source helpdesk platform allows unauthenticated attackers to force the server to fetch arbitrary URLs. This server-side request forgery vulnerability, identified as CVE-2026-111663, affects all versions of Chaskiq up to and including 2.0.3. The National Vulnerability Database rates the issue as critical with a CVSS score of 9.2. Attackers can exploit this weakness to access sensitive internal resources that should remain hidden from external users.

How the exploitation works

The vulnerability resides in the createUrlUpload GraphQL mutation within the Chaskiq application. An attacker sends a POST request to the /graphql endpoint, specifying an internal URL as the target for the upload. The server processes this request and fetches the content from the specified internal address. The attacker then retrieves the full response by accessing the ActiveStorage blob URL returned by the application.

Why cloud metadata is at risk

Because the server makes the request, it can reach internal network addresses that are not directly accessible from the internet. Attackers can target cloud instance metadata endpoints, which often contain sensitive credentials and configuration details. This allows them to harvest authentication tokens or other secrets stored on the host machine. The ability to fetch arbitrary URLs makes this a high-value target for reconnaissance and further compromise.

What makes this vulnerability critical

The National Vulnerability Database assigns a CVSS score of 9.2 to CVE-2026-111663, classifying it as critical. The weakness is categorized under CWE-918, which covers server-side request forgery. The lack of authentication requirements for the GraphQL mutation lowers the barrier for exploitation. Any user with network access to the Chaskiq instance can potentially trigger the attack without needing valid login credentials.

What happens next for users

No patch or fix has been confirmed by the vendor for versions up to 2.0.3. Users running affected versions should assess their exposure immediately. Organizations should consider restricting network access to the Chaskiq instance or implementing additional firewall rules to block outbound requests from the application server. Monitoring for unusual outbound traffic may help detect exploitation attempts before significant damage occurs.

What analysts watch for

Security teams usually monitor for unexpected outbound connections from application servers, especially to internal IP ranges or cloud metadata services. Analysts examine GraphQL logs for unusual mutation patterns, particularly those involving URL uploads or external resource fetching. They check for ActiveStorage blob creations that do not correspond to legitimate user uploads. Investigating request headers and payload structures helps identify automated scanning tools. Teams also review access controls to ensure internal endpoints are not inadvertently exposed to unauthenticated users through application logic flaws.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: Chaskiq

• Restrict outbound network traffic from Chaskiq servers to prevent access to internal metadata endpoints.
• Monitor GraphQL endpoints for unusual createUrlUpload mutation activity from unauthenticated sources.
• Implement firewall rules to block requests to known cloud provider metadata IP addresses.
• Review application logs for suspicious ActiveStorage blob creations that may indicate exploitation.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Chaskiq are affected by CVE-2026-111663?

All versions of Chaskiq up to and including 2.0.3 are affected by this vulnerability.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-111663 with a CVSS score of 9.2, which is critical.

How do attackers exploit this vulnerability?

Attackers submit internal URLs via the createUrlUpload GraphQL mutation and retrieve responses through ActiveStorage blob URLs.