---
id: CVE-2026-54589
title: >-
  Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data
  Connection outbound policy (validateOutboundUrl)
summary: >-
  Chartbrew is an open-source web application that can connect directly to
  databases and APIs and use the data to create charts. Prior to 5.2.1, the
  outbound URL guard recognized ordinary IPv4, IPv6, and IPv4-mapped IPv6
  destinations but d…
severity: high
cvss: 7
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-918
vendor: chartbrew
product: chartbrew
affected:
  - chartbrew < 5.2.1
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T21:03:30.050Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54589'
references:
  - url: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8
    label: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8
  - url: >-
      https://github.com/chartbrew/chartbrew/commit/8cfac8076bb0001b1571d93ef923698f53767751
    label: >-
      https://github.com/chartbrew/chartbrew/commit/8cfac8076bb0001b1571d93ef923698f53767751
  - url: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1'
    label: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1'
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.335Z'
epss: 0.00344
epssPercentile: 0.28066
---

## Overview

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, the outbound URL guard recognized ordinary IPv4, IPv6, and IPv4-mapped IPv6 destinations but did not recognize IPv4 addresses embedded in NAT64 prefixes. The vulnerable surface is aPI Data Connection outbound requests routed through server/modules/outboundTargetPolicy.js. An authenticated user with permission to create or edit an API connection supplies an attacker-controlled hostname or redirect whose DNS answer is a NAT64 address embedding a private or link-local IPv4 destination. The policy treated the NAT64 address as public; a NAT64 gateway then translated it to the embedded private IPv4 address after validation. The bypass requires a NAT64/DNS64 deployment path and connection-management privileges. IPv4-only deployments are not affected by this specific bypass. The attacker can read responses from 169.254.169.254 cloud metadata and arbitrary internal IPv4 hosts and ports reachable through the NAT64 gateway. This issue is fixed in version 5.2.1.

## Affected

- `chartbrew < 5.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.