{"metadata": {"vulnerability": "cve-2026-111663", "count": 14, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-111663", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:31:16.640Z", "date_only": false, "value": "2026-10-16T14:31:16.640Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-111663", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:26.910Z", "date_only": false, "value": "2026-10-16T17:39:26.910Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-111663", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:39:26.910Z", "date_only": false, "value": "2026-10-16T17:39:26.910Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-111663", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:39:26.910Z", "date_only": false, "value": "2026-10-16T17:39:26.910Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-111663", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:48Z", "date_only": false, "value": "2026-10-16T18:17:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RGGR-4J68-HC5W", "record": "GHSA-RGGR-4J68-HC5W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:48.077Z", "date_only": false, "value": "2026-10-16T18:17:48.077", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111663", "record": "FKIE_CVE-2026-111663", "field": "published"}, {"timestamp": "2026-10-16T18:28:49.199Z", "date_only": false, "value": "2026-10-16T18:28:49.199034Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452002336890954", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "72561694-9e95-47e0-9083-ab1917bf2905", "content": "CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111663https://hackmd.io/@hieuPenguinnn/chaskiq-unauthenticated-ssrf-oembed-url-uploadhttps://github.com/chaskiq/chaskiq/blob/2.0.3/app/graphql/mutations/create_url_upload.rb#L29-L66https://github.com/chaskiq/chaskiq/blob/2.0.3/app/controllers/graphql_controller.rb#L3-L33https://www.vulncheck.com/advisories/chaskiq-through-2.0.3-ssrf-via-createurlupload-graphql-mutation#chaskiq#CVE_2026_111663#bot", "url": "https://infosec.exchange/users/cve/statuses/117452002336890954"}, {"timestamp": "2026-10-16T18:34:48Z", "date_only": false, "value": "2026-10-16T18:34:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RGGR-4J68-HC5W", "record": "GHSA-RGGR-4J68-HC5W", "field": "published"}, {"timestamp": "2026-10-16T18:34:48Z", "date_only": false, "value": "2026-10-16T18:34:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RGGR-4J68-HC5W", "record": "GHSA-RGGR-4J68-HC5W", "field": "modified"}, {"timestamp": "2026-10-16T19:03:18.127Z", "date_only": false, "value": "2026-10-16T19:03:18.127", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111663", "record": "FKIE_CVE-2026-111663", "field": "lastModified"}, {"timestamp": "2026-10-16T20:08:52.939Z", "date_only": false, "value": "2026-10-16T20:08:52.939342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzexuyzqy2w", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "119f3fb4-3bb9-40e8-b876-d26abe4331fb", "content": "\ud83d\udea8 CVE-2026-111663 \u2014 CVSS 9.2 CRITICAL\n\nChaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated atta...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111663\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxzexuyzqy2w"}, {"timestamp": "2026-10-16T20:40:06.604Z", "date_only": false, "value": "2026-10-16T20:40:06.604229Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzgpplfeh2n", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "50b8db53-cf68-4cec-9f48-1548bbce7439", "content": "CVE-2026-111663 - chaskiq\nThe Chaskiq service (up to version 2.0.3) lets anyone send a special request that makes the server fetch any web address, even hidden internal ones like cloud metadata pages. The server then\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#chaskiq #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxzgpplfeh2n"}, {"timestamp": "2026-10-17T09:00:26.717Z", "date_only": false, "value": "2026-10-17T09:00:26.717358Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117455429686216788", "record": "CVE-2026-111663", "field": "creation_timestamp", "uuid": "8cf87c17-83a4-4612-8fa8-4e782b877c51", "content": "CRITICAL SSRF in Chaskiq <=2.0.3 (CVE-2026-111663): Unauthenticated attackers can fetch internal/cloud URLs via GraphQL, risking sensitive data exposure. Restrict /graphql access & monitor POSTs. CVSS 8.6. https://radar.offseq.com/threat/chaskiq-through-203-contains-a-server-side-request-forgery-vulnerability-that-allows-unauthenticated-cc1602d36198eead #OffSeq #SSRF #Chaskiq #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/117455429686216788"}]}