CVE-2026-61743 Details
Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl() to resolve and validate a target hostname, but request-promise performs a separate DNS resolution for the actual connection. An authenticated user who can create or test API connections and controls the target DNS name can return a public address during validation and a private address during the request, bypassing the protections implemented by server/modules/outboundTargetPolicy.js. This DNS rebinding condition can expose internal services, localhost resources, or cloud metadata endpoints. This issue is fixed in version 5.2.2.
A vulnerability in Chartbrew prior to version 5.2.2 allows authenticated users to bypass server-side request forgery (SSRF) protections through a DNS rebinding attack. The issue arises because the application's outbound URL validation and the actual HTTP request use separate DNS resolutions. An attacker controlling the target DNS name can manipulate the responses to first validate a public address and then route the request to a private one, accessing internal services or cloud metadata endpoints. This vulnerability affects Chartbrew versions through 5.2.1.
Users are advised to update to Chartbrew version 5.2.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9537-vm84-j26f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/chartbrew/chartbrew/commit/d38d745fe9e45563be8c33e4c7a17788ee6f13a3 | [email protected] | Source CodeVendor |
| https://github.com/chartbrew/chartbrew/releases/tag/v5.2.2 | [email protected] | Release NotesVendor |
| https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9537-vm84-j26f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Chartbrew | <= 5.2.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |