CVE-2026-61743: Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl() to resolve and validate a target hostname, but request-promise performs a separate DNS resolution for the actual connection. An authenticated user who can create or test API connections and controls the target DNS name can return a public address during validation and a private address during the request, bypassing the protections implemented by server/modules/outboundTargetPolicy.js. This DNS rebinding condition can expose internal services, localhost resources, or cloud metadata endpoints. This issue is fixed in version 5.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be able to create or test API connections and control the DNS name used as the outbound target. The attack relies on returning a public IP address during validation and a private IP address when the actual request is made.
What systems or resources could be reached through exploitation?
The bypass can expose internal services, localhost resources, and cloud metadata endpoints that the outbound target policy was intended to block.
Are default outbound-request protections sufficient?
No. The affected validation resolves the hostname separately from the HTTP client’s connection attempt, allowing DNS rebinding to bypass the outbound target policy.
What is the remediation?
Upgrade Chartbrew to version 5.2.2, which fixes the issue.