stoatchat CVE-2026-63306

Exploitation requires that the vulnerable /proxy or /embed endpoint be network-reachable by the attacker; these endpoints exist and are enabled in stoatchat versions before 0.13.5. No authentication and no user interaction are required (CVSS PR:N/UI:N). The concrete prerequisite is the ability to submit an arbitrary URL to /proxy or /embed; the endpoints perform no DNS-resolution filtering and no private-IP-range validation, and follow redirect chains, which is precisely what enables the attack. Impact is meaningfully increased when the instance runs in a cloud environment with a reachable metadata service (e.g. 169.254.169.254) or has internal services co-located on the same network segment. Limiting factors: the attacker must be able to reach the stoatchat HTTP interface (instances behind a VPN or IP allowlist, or with the proxy/embed endpoints disabled, are not exposed), the value of the attack depends on what internal targets exist, and enforced IMDSv2 or strict egress filtering reduces the achievable impact.

The signals are internally consistent and point to a genuine high priority for anyone running stoatchat exposed to untrusted networks. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, 9.2) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack with high confidentiality impact on both the vulnerable system and a subsequent system (SC:H) - the latter reflecting that SSRF pivots into internal infrastructure. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this data. It is not in CISA KEV (no confirmed active exploitation) and no POC was supplied, so exploitation is not confirmed in the wild. The counterweight is deployment footprint: stoatchat is a niche product, so real-world exposure is far narrower than the CVSS number alone implies. Net: high technical severity and trivial exploitability, but likely limited or targeted rather than mass exploitation given the product's small footprint. No conflicting signals were identified in the input.

An attacker with only network access to a stoatchat instance sends a request to the /proxy or /embed endpoint containing a URL such as http://169.254.169.254/latest/meta-data/ or an internal host, or an attacker-controlled URL that redirects into the internal network. The server dutifully fetches the target and returns or reflects the response, letting the attacker map internal services and harvest cloud metadata/credentials. No authentication, user interaction, or special client is required; no public POC is currently identified.