CVE-2026-30232

CRITICAL

Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

Title source: cna
STIX 2.1

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

References (2)

Core 2

Scores

CVSS v3 9.6
EPSS 0.0024
EPSS Percentile 15.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-918
Status published
Products (2)
chartbrew/chartbrew < 4.8.5
depomo/chartbrew < 4.8.5
Published Apr 10, 2026
Tracked Since Apr 11, 2026