Which versions of Chartbrew are affected by EUVD-2026-21551?

Chartbrew versions before 4.8.5 contain a Server-Side Request Forgery vulnerability that allows authenticated users to probe internal networks and access cloud metadata endpoints, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-21551?

Within 24 hours: Inventory all Chartbrew deployments and identify instances running versions prior to 4.8.5. Within 7 days: Upgrade all affected Chartbrew instances to version 4.8.5 or later; restrict API data connection creation to administrative users only pending patch application. Within 30 days: audit API data connection logs for suspicious internal or metadata endpoint URLs; review IAM policies to limit Chartbrew service account permissions to only necessary external endpoints.

Chartbrew EUVD-2026-21551

Q: What is the CVSS score of EUVD-2026-21551?

EUVD-2026-21551 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-30232 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-10 GitHub_M

SSRF Chartbrew

7.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.8.5

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21551

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

CVE Published

Apr 10, 2026 - 19:15 nvd

HIGH 7.8

DescriptionGitHub Advisory

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

AnalysisAI

Server-Side Request Forgery in Chartbrew versions prior to 4.8.5 allows authenticated users to create API data connections with arbitrary URLs, enabling attacks against internal networks and cloud metadata endpoints. The vulnerability stems from unvalidated URL fetching via request-promise library, permitting attackers to probe internal infrastructure, access cloud instance metadata (AWS, Azure, GCP), and potentially retrieve sensitive credentials or configuration data. No public exploit identified at time of analysis. CVSS 7.8 with network attack vector and no authentication requirement in subsequent chain exploitation.

Technical ContextAI

Root cause is absence of IP address validation in request-promise HTTP client when processing user-supplied API connection URLs. CWE-918 SSRF enables bypass of network segmentation controls. Authenticated context (PR:N in vector appears inconsistent with description requiring authentication) allows crafted requests to internal RFC1918 addresses and cloud metadata services (169.254.169.254).

RemediationAI

Vendor-released patch: version 4.8.5. Immediate upgrade to Chartbrew 4.8.5 is required, which implements IP address validation and request filtering to prevent SSRF attacks. Organizations unable to upgrade immediately should restrict API data connection creation privileges to trusted administrators only and implement network egress filtering to block access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254/32) from Chartbrew server instances. Review existing API connections for suspicious internal URLs. Vendor security advisory: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv. Patch commit reference: https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1.