# cve.now: Chartbrew

The newest entries naming Chartbrew as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-69128](https://cve.now/CVE-2026-69128.md): Chartbrew: AI orchestrator run\_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier +… (CVSS 4.6)
- [CVE-2026-68935](https://cve.now/CVE-2026-68935.md): Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections (CVSS 9.1)
- [CVE-2026-68933](https://cve.now/CVE-2026-68933.md): Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage (CVSS 7.5)
- [CVE-2026-86005](https://cve.now/CVE-2026-86005.md): Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew (CVSS 9.3)
- [CVE-2026-85736](https://cve.now/CVE-2026-85736.md): Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths (CVSS 8.1)
- [CVE-2026-85726](https://cve.now/CVE-2026-85726.md): Chartbrew: Blind NoSQL injection via date variable in embedded chart (CVSS 7.5)
- [CVE-2026-85712](https://cve.now/CVE-2026-85712.md): Chartbrew: Cross-tenant project takeover via body.team\_id in /project routes (CVSS 8.8)
- [CVE-2026-85708](https://cve.now/CVE-2026-85708.md): Chartbrew: Private chart data disclosure via forgeable CB\_SECRET share tokens (CVSS 7.5)
- [CVE-2026-85295](https://cve.now/CVE-2026-85295.md): Chartbrew: Full account takeover via JWTs accepted under default CB\_SECRET (CVSS 9.8)
- [CVE-2026-54349](https://cve.now/CVE-2026-54349.md): Chartbrew SQL injection in dashboard filter substitution (CVSS 9.8)
- [CVE-2026-54589](https://cve.now/CVE-2026-54589.md): Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl) (CVSS 7.0)
- [CVE-2026-65980](https://cve.now/CVE-2026-65980.md): Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution (CVSS 7.9)
- [CVE-2026-61851](https://cve.now/CVE-2026-61851.md): Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool (CVSS 6.5)
- [CVE-2026-61852](https://cve.now/CVE-2026-61852.md): Chartbrew: SQL Injection via row\_limit Parameter in AI runQuery Tool (CVSS 5.8)
- [CVE-2026-61743](https://cve.now/CVE-2026-61743.md): Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation (CVSS 6.3)
- [CVE-2026-41518](https://cve.now/CVE-2026-41518.md): Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) (CVSS 7.6)
- [CVE-2026-40603](https://cve.now/CVE-2026-40603.md): Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override (CVSS 6.5)
- [CVE-2026-40601](https://cve.now/CVE-2026-40601.md): Chartbrew: Missing Authorization in /api/chart/:chart\_id/query via team-level refresh toggle (CVSS 7.5)
- [CVE-2026-40600](https://cve.now/CVE-2026-40600.md): Chartbrew: Incorrect Access Control in project share policy routes via unbound policy\_id (CVSS 8.1)
- [CVE-2026-40595](https://cve.now/CVE-2026-40595.md): Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks (CVSS 7.5)
- [CVE-2026-35514](https://cve.now/CVE-2026-35514.md): Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew (CVSS 6.5)
- [CVE-2026-40904](https://cve.now/CVE-2026-40904.md): Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks (CVSS 8.1)
- [CVE-2026-32252](https://cve.now/CVE-2026-32252.md): Chartbrew Cross-Tenant Template Export and Secret Disclosure in \`GET /team/:team\_id/template/generate/:project\_id\` (CVSS 7.7)
- [CVE-2026-30232](https://cve.now/CVE-2026-30232.md): Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs (CVSS 7.8)
- [CVE-2026-27605](https://cve.now/CVE-2026-27605.md): Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API (CVSS 6.3)
- [CVE-2026-27603](https://cve.now/CVE-2026-27603.md): Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project\_id/chart/:chart\_id/filter missing verifyToken + checkPermissions (CVSS 8.7)
- [CVE-2026-27005](https://cve.now/CVE-2026-27005.md): Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) (CVSS 8.8)
- [CVE-2026-25888](https://cve.now/CVE-2026-25888.md): Chartbrew: Remote Code Execution (RCE) via Vulnerable API (CVSS 8.8)
- [CVE-2026-25887](https://cve.now/CVE-2026-25887.md): Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query (CVSS 7.2)
- [CVE-2026-25877](https://cve.now/CVE-2026-25877.md): Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/chartbrew
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.