Chaskiq EUVD-2026-103084

No special configuration required - the /oembed endpoint is reachable by remote unauthenticated attackers (PR:N/UI:N) and processes the attacker-controlled url parameter by default in Chaskiq through 2.0.3. Exploitation is aided by FetchLinkCardService following HTTP redirects (enabling filter bypass) and skipping TLS verification (enabling HTTPS internal targets). The primary LIMITING factor is the data returned: the attacker only recovers the fetched page's title and description, not arbitrary response bodies, so exfiltration is restricted to metadata/recon rather than full internal content; successful cloud-metadata theft additionally requires the Chaskiq instance to run in an environment exposing a link-local metadata service (e.g. a cloud VM).

This is a genuine but moderate-severity SSRF (CWE-918) in Chaskiq, scored CVSS 4.0 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N and limited impact VC:L/SC:L. The exposure signals align coherently: network-reachable, no privileges (PR:N), and no user interaction (UI:N) make this trivially triggerable by remote unauthenticated attackers, which is a real priority factor. However, impact is deliberately constrained - the vector marks only low confidentiality on the vulnerable and subsequent systems (VC:L/SC:L) with no integrity or availability impact, because the attacker only recovers internal page titles and descriptions rather than full response bodies, so this is not a full blind-to-full-read SSRF. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; a detailed public technical write-up (hackmd) and a VulnCheck advisory exist, meaning exploitation details/POC are publicly available but that must not be conflated with in-the-wild use. The practical danger is elevated by two implementation details named in the description - FetchLinkCardService follows redirects and skips TLS verification - which make common SSRF mitigations (redirect-based filter bypass, HTTPS-only metadata endpoints) less effective. Net: a real, easily-triggered reconnaissance/metadata-theft primitive against affected deployments, but bounded data return keeps it Medium rather than Critical; no conflicting signals were detected in the provided data.

A remote unauthenticated attacker sends a crafted request to the public /oembed endpoint with a url parameter pointing at a cloud metadata service (e.g. 169.254.169.254) or an internal loopback/private address. Because FetchLinkCardService follows redirects and skips TLS verification, the Chaskiq server fetches the internal resource and returns its page title and description to the attacker, leaking internal service details or cloud instance metadata. A public technical write-up and VulnCheck advisory describe the exploitation path, so working exploit details are available.