Chartbrew CVE-2026-61743

Requires an authenticated Chartbrew account with permission to create or test API/data-source connections, AND attacker control over DNS resolution for the target hostname so that validateOutboundUrl() (in server/modules/safeRequest.js) resolves a public address while request-promise's separate resolution returns a private one. The TOCTOU/rebinding race must be won between the two independent DNS lookups. It is limited to versions prior to 5.2.2 and is config-independent (no non-default feature toggle needed), but the dual requirement of credentialed access plus DNS control materially constrains real-world exploitation. No user interaction by a victim is needed.

Moderate, gated risk that is correctly rated rather than inflated. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N, 6.3 MEDIUM) is internally consistent with the described mechanism: DNS rebinding is a network-reachable but timing-dependent race (AC:H), it requires an authenticated user able to create/test API connections (PR:L), and success reaches internal-only services beyond the app's trust boundary (S:C, C:H, no integrity/availability impact). No EPSS score, no CISA KEV listing, and no public POC were provided; per input signals this is 'no public exploit identified at time of analysis.' The two key gating factors - a valid application account with connection-creation privileges AND the ability to control DNS responses for a target hostname (win the validate-vs-connect race) - meaningfully lower real-world likelihood versus an unauthenticated SSRF. Confidentiality impact is genuinely high because the classic payoff is cloud metadata (IMDS) credential theft or reaching localhost/internal admin services. Net: a real issue worth patching for anyone exposing Chartbrew connection features to semi-trusted users, but not an emergency mass-exploitation candidate. No conflicting signals were found between the CVSS vector and the description; both point to authenticated, network-origin, config-independent behavior.

An authenticated Chartbrew user with permission to create or test an API data-source connection points it at a hostname on a DNS server they control, which answers with a public IP the first time (passing validateOutboundUrl) and a private IP such as 169.254.169.254 or 127.0.0.1 on the second, actual request. Chartbrew then fetches from the internal address, returning cloud metadata, localhost admin endpoints, or other internal service responses to the attacker. No public exploit code is identified, though the vendor's regression test in the patch demonstrates the exact rebinding technique.