CVE-2026-30232
Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
10 abr 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Productos afectados
chartbrew · chartbrew¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →