Chartbrew CVE-2026-65980

Requires a Chartbrew instance (prior to 5.2.3) with a chart backed by a ClickHouse data source that uses variable binding in its query, where the attacker can supply the variable value. Unauthenticated exploitation is possible specifically when that chart is served through a public dashboard, which exposes the vulnerable applySqlVariables() path without a login; on non-public dashboards the same path requires an authenticated session. Impact escalation to file access or internal-network reachability further depends on the ClickHouse server configuration permitting such operations (e.g. file table functions / URL access). Limiting factors: the ClickHouse plugin must be in use, the query must include variable binding, and the fix (escapeBackslash:true) closes the vector entirely in 5.2.3.

This is a genuine, high-priority SQL injection (CWE-89) with a credible unauthenticated path. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 7.9) indicates network-reachable, low-complexity, no-privilege, no-user-interaction exploitation, which is consistent with the description's statement that public dashboards expose the vulnerable variable-binding path without authentication. Note an internal quirk in the vendor vector: the vulnerable-system impacts (VC/VI/VA) are all N while subsequent-system impacts (SC/SI/SA) are all H - the vendor modeled the impact as falling on the connected ClickHouse database rather than the Chartbrew app itself, which is defensible for injection into a downstream data store but makes the raw metric look counterintuitive. No EPSS score, no CISA KEV listing, and no standalone weaponized exploit are present in the input - only the fix commit diff and a regression unit test demonstrating the break-out payload. Therefore exploitation status is: no public exploit identified at time of analysis. The real-world risk is moderated by prevalence: Chartbrew is a niche open-source BI tool, so this is a real technical priority for the specific population running ClickHouse-backed public dashboards, not a widespread internet-scale threat. Conflict to verify: PR:N/unauthenticated is only true when a public dashboard exposes the affected chart; for private dashboards the same flaw requires an authenticated session.

An attacker browses a Chartbrew public dashboard whose chart is backed by ClickHouse and accepts a variable binding. They submit a variable value containing a backslash immediately before a quote (e.g. x\' OR 1=1 -- ); the missing escapeBackslash option means quote-doubling no longer keeps the value inside its SQL string literal, so the injected clause executes as arbitrary ClickHouse SQL to exfiltrate data or, where the DB config permits, read files or reach internal network resources. No public weaponized exploit is published, but the vendor's own regression test in the fix commit demonstrates the exact break-out payload, and low attack complexity with no authentication (on public dashboards) makes this readily reproducible.