# CVE-2026-30232: Chartbrew SSRF in API Data Connection

Source: https://junglewise.ai/threats/cve-2026-30232-chartbrew-ssrf-in-api-data-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-30232 · Severity: critical · CVSS 9.6 · Published 2026-04-10

Chartbrew, an open-source data visualization platform, is vulnerable to a security flaw that allows users to force the server to make unintended network requests. An attacker with a valid account could use this to access sensitive internal company data, scan private networks, or steal cloud service credentials (like AWS metadata). This could lead to a full compromise of the cloud environment or unauthorized access to internal databases and services.

Technologies: [Depomo Chartbrew](https://junglewise.ai/threats/technologies/chartbrew). Vendors: [Depomo](https://junglewise.ai/threats/vendors/depomo).

## Quick answers

**Is CVE-2026-30232 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30232 being exploited in the wild.

**How severe is CVE-2026-30232?** Critical severity, with a CVSS score of 9.6, published 10 April 2026.

**Which products and versions are affected?** Chartbrew Chartbrew < 4.8.5.

**Is there a fix for CVE-2026-30232?** A patch was published on 2026-03-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30232 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-30232?** Check whether you run Depomo Chartbrew. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Chartbrew's ConnectionController. The application uses the 'request-promise' library to fetch user-provided URLs for API data connections without implementing IP address validation or blocklists. An authenticated attacker can provide URLs pointing to internal IP ranges (e.g., 10.0.0.0/8) or cloud metadata services (e.g., 169.254.169.254). This allows for the exfiltration of sensitive information such as IAM credentials or interaction with internal services that are not exposed to the public internet. The vulnerability is fixed in version 4.8.5 by introducing a private network request flag.

## Affected products

- Chartbrew Chartbrew < 4.8.5

## Timeline

- 2026-03-05: patched: Fix committed to repository
- 2026-04-10: disclosed: Initial advisory published
- 2026-04-10: advisory: GitHub Security Advisory published

## References

- [https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1](https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1)
- [https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv)

## Related threats

- [Chartbrew authorization bypass in template generation API](https://junglewise.ai/threats/cve-2026-32252-chartbrew-authorization-bypass-in-template-generation-api)