CVE-2026-30232
Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- State
- Published
- Severity
- 7.8 High
- Published
- Apr 10, 2026
- Updated
- Apr 15, 2026
- Reserved
- Mar 4, 2026
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N | GitHub_M |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
chartbrewchartbrew |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.