EUVD-2026-21551Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Chartbrew interface
-
ExploitCreate API data connection with malicious URL
-
ExecutionServer fetches internal network endpoint
-
ImpactAccess cloud metadata or internal services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to Chartbrew versions prior to 4.8.5. Attacker must be a registered user able to create API data connections. The server must be configured to allow outbound HTTP/HTTPS requests to arbitrary URLs without IP filtering. No victim interaction required beyond initial authentication. |
| Impact | CVSS 7.8 reflects high scope impact on internal systems and cloud metadata. SSRF against unauthenticated endpoints enables attackers to pivot internally, access cloud credentials, or exfiltrate sensitive data. No public exploit identified at time of analysis. Immediate patching critical for instances exposing Chartbrew to untrusted networks. |
| Exploit ScenarioDerived | Attacker accesses Chartbrew UI, creates API data connection pointing to http://169.254.169.254/latest/meta-data (AWS metadata) or internal service. Server fetches URL without validation, returning credentials or service responses to attacker's account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Server-Side Request Forgery in Chartbrew versions prior to 4.8.5 allows authenticated users to create API data connections with arbitrary URLs, enabling attacks against internal networks and cloud metadata endpoints. The vulnerability stems from unvalidated URL fetching via request-promise library, permitting attackers to probe internal infrastructure, access cloud instance metadata (AWS, Azure, GCP), and potentially retrieve sensitive credentials or configuration data. No public exploit identified at time of analysis. CVSS 7.8 with network attack vector and no authentication requirement in subsequent chain exploitation.
RemediationAI
Vendor-released patch: version 4.8.5. Immediate upgrade to Chartbrew 4.8.5 is required, which implements IP address validation and request filtering to prevent SSRF attacks. Organizations unable to upgrade immediately should restrict API data connection creation privileges to trusted administrators only and implement network egress filtering to block access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254/32) from Chartbrew server instances. Review existing API connections for suspicious internal URLs. Vendor security advisory: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv. Patch commit reference: https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is absence of IP address validation in request-promise HTTP client when processing user-supplied API connection URLs. CWE-918 SSRF enables bypass of network segmentation controls. Authenticated context (PR:N in vector appears inconsistent with description requiring authentication) allows crafted requests to internal RFC1918 addresses and cloud metadata services (169.254.169.254).
Know when Chartbrew gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.
Executive ViewAI
Chartbrew versions before 4.8.5 contain a Server-Side Request Forgery vulnerability that allows authenticated users to probe internal networks and access cloud metadata endpoints, potentially exposing credentials and sensitive configuration data. This poses significant risk to organizations using Chartbrew in environments with cloud deployments or sensitive internal systems. Immediate patching is critical to prevent insider threats and lateral movement attacks.
Vendor-released patch: Chartbrew 4.8.5. Until patching: (1) Restrict API data connection creation to administrative users with formal approval process; (2) implement network segmentation to block Chartbrew instances from accessing internal subnets and cloud metadata endpoints (169.254.169.254 for AWS, similar for Azure/GCP); (3) deploy egress filtering rules limiting outbound connections to explicitly approved external domains only; (4) enable audit logging for all API connection configurations and review weekly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
SQL injection in Chartbrew before 4.8.3. PoC available.
Remote code execution in Chartbrew prior to version 4.8.1 allows authenticated attackers to execute arbitrary code throu
Chartbrew versions up to 4.8.4 is affected by missing authentication for critical function (CVSS 7.5).
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
Chartbrew versions before 4.8.1 fail to validate chart ownership during modification operations, allowing authenticated
Chartbrew versions prior to 4.8.4 allow authenticated users to upload arbitrary files by bypassing file type validation,
Authenticated users in Chartbrew 4.9.0 can modify or delete dashboard sharing policies across projects they don't own du
Horizontal privilege escalation in Chartbrew 4.9.0 allows authenticated low-privilege team members to access datasets, d
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended
Cross-tenant authorization bypass in Chartbrew versions prior to 4.9.0 allows authenticated attackers to exfiltrate sens
Unauthenticated remote attackers can access and refresh private chart data in Chartbrew 4.9.0 via an exposed API endpoin
Chartbrew 4.9.0 allows unauthenticated attackers to access hidden chart data via authentication bypass in public chart e
Exploit-DB