External risk intelligence

Chaskiq SSRF via GraphQL Mutation

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-111663

Chaskiq is a customer service and messaging platform designed to be internet-facing for web chat and user engagement. The vulnerability exists within a GraphQL endpoint that is typically exposed to the public internet to facilitate its primary function of processing incoming messages and media uploads from web visitors.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Chaskiq software that could allow unauthorized access to internal systems and cloud metadata. This flaw, present in versions prior to 2.0.3, leverages a feature that processes uploaded URLs, enabling attackers to potentially query sensitive endpoints. The primary concern is to determine if this specific Chaskiq functionality is in use within our environment.

Attackers can access internal systems.
Matters if Chaskiq is actively used.
Verify relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the application's GraphQL endpoint. This request targets the `createUrlUpload` mutation, tricking the server into fetching arbitrary URLs, including those pointing to internal cloud services. The server then returns the fetched content, potentially exposing sensitive information or allowing further access.

Unauthenticated access to the GraphQL endpoint.
Submitting an internal URL via `createUrlUpload`.
Sensitive data exposure and internal system access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to access internal network resources or sensitive cloud instance metadata by tricking the application into making requests on their behalf. This is possible when the application processes URLs submitted through a specific GraphQL mutation.

Internal network resources.
Application makes requests to attacker-supplied URLs.
Exposure of sensitive internal information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Chaskiq platform, particularly its GraphQL endpoint, is likely managed by a combination of application owners and platform teams, with oversight from security and network teams due to its internet-facing nature. The immediate priority is to pinpoint all instances of Chaskiq within your environment, confirm their accessibility and criticality, and then engage the accountable owners to develop a targeted remediation plan.

Identify Chaskiq instances and their owners.
Verify external access and business criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chaskiq and how is it used?

Chaskiq is an open-source customer service and messaging platform. Organizations deploy it to manage real-time communication with web visitors, often embedding its chat widgets directly into their websites to provide support, gather user feedback, and handle incoming media uploads from customers.

What does CVE-2026-111663 mean in plain English?

This vulnerability is a Server-Side Request Forgery (SSRF), classified as CWE-918. It means an attacker can manipulate the application into acting as a proxy. Instead of the server only fetching legitimate user-provided files, it can be tricked into visiting internal web addresses or cloud environment management interfaces that were never meant to be accessed by the public.

How do attackers trigger this Chaskiq vulnerability?

An attacker triggers this by sending a specially crafted request to the application's GraphQL endpoint using the 'createUrlUpload' mutation. They provide a specific target URL they want the server to visit. Importantly, this does not require any authentication or user account privileges; simply having access to the public-facing GraphQL interface is enough to initiate the malicious request.

Is my Chaskiq instance at risk?

According to Halo Surface Signal, Chaskiq is designed to be internet-facing to support web chat functions. If your instance is accessible from the public internet, it is inherently reachable by attackers. The risk is significant if your Chaskiq deployment runs within a network that hosts internal services or cloud metadata endpoints accessible via HTTP.

What steps should I take if I run Chaskiq?

First, identify all Chaskiq deployments within your environment and verify their business criticality. Since this involves a component specifically designed for public interaction, coordinate with your platform and security teams to review the application configuration. Prioritize assessing the exposure of the GraphQL endpoint and plan for updates to secure the URL upload process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.