Attack Chain

1. Attacker authenticates to the prompts.chat application.
2. Attacker crafts a malicious URL containing a server controlled by them.
3. The attacker initiates a media status polling request to Fal.ai, injecting the malicious URL into the token parameter.
4. The prompts.chat server, lacking proper URL validation, makes an outbound HTTP request to the attacker’s server.
5. The request includes the Authorization header, potentially exposing the FAL_API_KEY.
6. The attacker’s server captures the Authorization header containing the FAL_API_KEY.
7. The attacker uses the stolen FAL_API_KEY to access the victim’s Fal.ai account.
8. The attacker performs unauthorized actions, such as data exfiltration or resource abuse.

Impact

Successful exploitation of this SSRF vulnerability (CVE-2026-22664) allows attackers to steal the FAL_API_KEY, potentially impacting all users of the vulnerable prompts.chat application who utilize the Fal.ai integration. Consequences include unauthorized access to Fal.ai accounts, data breaches, internal network scans originating from the prompts.chat server, and financial losses due to resource abuse. The specific number of victims and the extent of the damage depend on the attacker’s objectives and the permissions associated with the compromised Fal.ai API key.

Recommendation

• Inspect web server logs for outbound requests to unusual or suspicious domains originating from the prompts.chat server to detect potential SSRF attempts (log source: webserver).
• Deploy the provided Sigma rule to detect HTTP requests containing a suspicious token parameter potentially indicative of SSRF exploitation.
• Monitor network traffic for unusual outbound connections from the prompts.chat server (log source: network_connection).
• Apply the patch or upgrade prompts.chat to a version after commit 30a8f04, which addresses the CVE-2026-22664 vulnerability.