What is the CVSS score of CVE-2026-27005?

CVE-2026-27005 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PostgreSQL are affected by CVE-2026-27005?

Chartbrew versions prior to 4.8.3 contain a critical SQL injection vulnerability that allows unauthenticated attackers to directly access and manipulate data in connected databases without valid…

Is there a public PoC exploit available for CVE-2026-27005?

Yes, a public proof-of-concept exploit is available for CVE-2026-27005. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-27005?

Within 24 hours: Immediately identify all Chartbrew instances in production and their version numbers; isolate affected instances from external network access if possible; enable verbose logging on connected databases. Within 7 days: Upgrade to Chartbrew 4.8.3 or later; audit database access logs for suspicious SQL activity; conduct data exposure assessment for accessed databases. Within 30 days: Perform full security review of Chartbrew deployment; implement network segmentation to restrict database access; establish monitoring for SQL injection patterns.

PostgreSQL CVE-2026-27005

CRITICAL

SQL Injection (CWE-89)

2026-03-06 security-advisories@github.com

PostgreSQL MySQL Chartbrew Depomo

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 14:04 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unauthenticated attacker can inject arbitrary SQL into queries executed against databases connected to Chartbrew (MySQL, PostgreSQL). This allows reading, modifying, or deleting data in those databases depending on the database user's privileges. This issue has been patched in version 4.8.3.