CVE-2026-68935: Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections
Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can enable this field to bypass private and reserved-network destination restrictions. An upgrade migration also enables the override on pre-existing API connections. The per-connection setting takes precedence over CBALLOWPRIVATENETWORKCALLS , so disabling that instance option does not protect connections with the override enabled. Successful exploitation allows requests to internal HTTP services reachable from the Chartbrew server, potentially disclosing information or triggering unauthorized actions depending on the target service. Recognized cloud metadata endpoints remain separately blocked. This issue is fixed in version 5.2.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Chartbrew versions 4.8.5 through 5.2.2 are affected. Exposure applies where an authenticated user has permission to create or manage API connections and the Chartbrew server can reach internal HTTP services.
What access does an attacker need to exploit this?
The attacker must be authenticated and have permission to manage API connections. They can then set the user-controlled allowPrivateHost field when creating or updating a connection.
Does disabling CB_ALLOW_PRIVATE_NETWORK_CALLS mitigate the issue?
No. The per-connection allowPrivateHost override takes precedence over CB_ALLOW_PRIVATE_NETWORK_CALLS, so connections with the override enabled can still target private or reserved-network destinations.
Could existing API connections already have the override enabled?
Yes. An upgrade migration enables the override on pre-existing API connections, so existing connections may be affected even if users did not newly create or update them.
What destinations remain protected?
Recognized cloud metadata endpoints remain separately blocked. Other internal HTTP services reachable from the Chartbrew server may be accessible through the vulnerable API connection behavior.