CVE-2026-30232CWE-918

Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

High · published April 10, 2026

CVSS v4.0
7.8
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

The record
Technical detail
CVSS v4.0
7.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-10T19:15Z
EPSS history
Timeline
  • 10 APR 19:15Z
    Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
    cvelistv5