CVE-2026-30232
CRITICALChartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
Title source: cnaDescription
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.
Scores
CVSS v3
9.6
EPSS
0.0003
EPSS Percentile
10.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Details
CWE
CWE-918
Status
published
Products (2)
chartbrew/chartbrew
< 4.8.5
depomo/chartbrew
< 4.8.5
Published
Apr 10, 2026
Tracked Since
Apr 11, 2026