Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M

CVE-2026-30232Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

High 7.8

In plain English

A high-severity server-side request forgery in chartbrew from chartbrew. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)7.8High

Exploit odds (30 days)0.2%top 84.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

Affected products (as reported)

Vendor	Product	Versions
chartbrew	chartbrew	< 4.8.5

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1 x_refsource_MISC