Chartbrew vulnerabilities
30 CVEs and advisories name Chartbrew as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-69128Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier +…
- CVE-2026-68935Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections
- CVE-2026-68933Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage
- CVE-2026-86005Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew
- CVE-2026-85736Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths
- CVE-2026-85726Chartbrew: Blind NoSQL injection via date variable in embedded chart
- CVE-2026-85712Chartbrew: Cross-tenant project takeover via body.team_id in /project routes
- CVE-2026-85708Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens
- CVE-2026-85295Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET
- CVE-2026-54349Chartbrew SQL injection in dashboard filter substitution
- CVE-2026-54589Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl)
- CVE-2026-65980Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution
- CVE-2026-61851Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool
- CVE-2026-61852Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
- CVE-2026-61743Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation
- CVE-2026-41518Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)
- CVE-2026-40603Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override
- CVE-2026-40601Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle
- CVE-2026-40600Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id
- CVE-2026-40595Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks
- CVE-2026-35514Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew
- CVE-2026-40904Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks
- CVE-2026-32252Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
- CVE-2026-30232Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- CVE-2026-27605Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API
- CVE-2026-27603Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions
- CVE-2026-27005Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
- CVE-2026-25888Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- CVE-2026-25887Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
- CVE-2026-25877Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations