# CVE-2026-22664: prompts.chat SSRF and credential leak in Fal.ai polling

Source: https://junglewise.ai/threats/cve-2026-22664-prompts-chat-ssrf-and-credential-leak-in-fal-ai-polling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-22664 · Severity: high · CVSS 7.7 · Published 2026-04-03

prompts.chat, a web application for managing AI prompts, is vulnerable to a security flaw in its media generation feature. An authenticated user can trick the server into sending requests to a malicious destination, which automatically includes the site's Fal.ai API key. This allows an attacker to steal credentials, incur unauthorized costs on the victim's AI account, and probe the internal network.

Technologies: [Fka Prompts.Chat](https://junglewise.ai/threats/technologies/prompts-chat). Vendors: [Fka](https://junglewise.ai/threats/vendors/fka).

## Quick answers

**Is CVE-2026-22664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22664 being exploited in the wild.

**How severe is CVE-2026-22664?** High severity, with a CVSS score of 7.7, published 3 April 2026.

**Which products and versions are affected?** fka prompts.chat prior to commit 30a8f04.

**Is there a fix for CVE-2026-22664?** A patch was published on 2026-03-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22664 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-22664?** Check whether you run Fka Prompts.Chat. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) exists in the Fal.ai media status polling feature within `src/lib/plugins/media-generators/fal.ts`. The application accepts a user-provided `token` parameter containing pipe-separated URLs which are subsequently fetched by the server. Because the application fails to validate these URLs before execution, it attaches the `FAL_API_KEY` in the Authorization header of requests sent to attacker-controlled endpoints. An authenticated attacker can exploit this to leak sensitive API credentials, scan internal network infrastructure, or access cloud metadata services. The vulnerability was addressed in commit 30a8f04 by implementing origin validation for the polling URLs.

## Affected products

- fka prompts.chat prior to commit 30a8f04

## Timeline

- 2026-03-24: disclosed: Vulnerability discovered and reproduced by researcher
- 2026-03-25: patched: Fix committed to repository
- 2026-04-03: advisory: Initial NVD publication

## References

- [https://gist.github.com/mdisec/27c0cac0ec6a8f3c8f85a18987ddb942](https://gist.github.com/mdisec/27c0cac0ec6a8f3c8f85a18987ddb942)
- [https://github.com/f/prompts.chat/commit/30a8f0470e0ba45e6be9c9f55220f4a9a6b91c99](https://github.com/f/prompts.chat/commit/30a8f0470e0ba45e6be9c9f55220f4a9a6b91c99)
- [https://www.vulncheck.com/advisories/prompts-chat-ssrf-via-fal-ai-media-status-polling](https://www.vulncheck.com/advisories/prompts-chat-ssrf-via-fal-ai-media-status-polling)

## Related threats

- [prompts.chat identity confusion via case-sensitive username handling](https://junglewise.ai/threats/cve-2026-22665-prompts-chat-identity-confusion-via-case-sensitive-username)
- [prompts.chat authorization bypass in API endpoints and metadata generation](https://junglewise.ai/threats/cve-2026-22663-prompts-chat-authorization-bypass-in-api-endpoints-and-metadata)
- [prompts.chat blind SSRF in Wiro media generator](https://junglewise.ai/threats/cve-2026-22662-prompts-chat-blind-ssrf-in-wiro-media-generator)
- [prompts.chat path traversal in skill file handling](https://junglewise.ai/threats/cve-2026-22661-prompts-chat-path-traversal-in-skill-file-handling)