CVE-2026-54589 Details
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, the outbound URL guard recognized ordinary IPv4, IPv6, and IPv4-mapped IPv6 destinations but did not recognize IPv4 addresses embedded in NAT64 prefixes. The vulnerable surface is aPI Data Connection outbound requests routed through server/modules/outboundTargetPolicy.js. An authenticated user with permission to create or edit an API connection supplies an attacker-controlled hostname or redirect whose DNS answer is a NAT64 address embedding a private or link-local IPv4 destination. The policy treated the NAT64 address as public; a NAT64 gateway then translated it to the embedded private IPv4 address after validation. The bypass requires a NAT64/DNS64 deployment path and connection-management privileges. IPv4-only deployments are not affected by this specific bypass. The attacker can read responses from 169.254.169.254 cloud metadata and arbitrary internal IPv4 hosts and ports reachable through the NAT64 gateway. This issue is fixed in version 5.2.1.
A server-side request forgery (SSRF) vulnerability has been identified in Chartbrew versions prior to 5.2.1. The issue arises in the outbound URL validation process for API Data Connections, where IPv6 NAT64 addresses are incorrectly classified as public. This flaw allows an authenticated user with permission to manage API connections to route requests through a NAT64 gateway, accessing private IPv4 metadata or internal hosts. The vulnerability is contingent on the Chartbrew instance being deployed in an environment that uses NAT64/DNS64 translation, such as certain cloud or Kubernetes settings.
Users can update to Chartbrew version 5.2.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chartbrew/chartbrew/commit/8cfac8076bb0001b1571d93ef923698f53767751 | [email protected] | Source CodeVendor |
| https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1 | [email protected] | Release NotesVendor |
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chartbrew | <= 5.2.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |