Is CVE-2026-54589 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54589 being exploited in the wild.

How severe is CVE-2026-54589?

Informational severity, published 6 November 2026.

Is there a fix for CVE-2026-54589?

Yes: fixed in 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54589 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54589?

Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54589: Chartbrew NAT64/DNS64 SSRF bypass in outbound policy

CVE-2026-54589 · Severity: info · Published 2026-11-06

Chartbrew is an open-source analytics tool that connects to databases and APIs to generate charts. An authenticated user with API connection privileges can bypass security checks by supplying a NAT64-addressed hostname, allowing them to reach internal cloud metadata services and private network hosts that should be blocked. This vulnerability only affects systems using IPv6 with NAT64/DNS64 translation.

Technologies: Chartbrew. Vendors: Chartbrew.

Quick answers

Is CVE-2026-54589 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54589 being exploited in the wild.
How severe is CVE-2026-54589?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Chartbrew before 5.2.1.
Is there a fix for CVE-2026-54589?: Yes: fixed in 5.2.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54589 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54589?: Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.2.1

Technical details

The outbound URL guard in server/modules/outboundTargetPolicy.js failed to recognize IPv4 addresses embedded within NAT64 prefixes (64:ff9b::/96 and 64:ff9b:1::/48), treating them as public IPv6 addresses. An authenticated attacker with API connection creation/edit permissions can supply a malicious hostname whose DNS response resolves to a NAT64-embedded private IPv4 address; the gateway then translates it post-validation, enabling SSRF access to cloud metadata (169.254.169.254) and internal RFC 1918 hosts. The attack requires a NAT64/DNS64 deployment and is fixed in version 5.2.1 by registering NAT64 prefixes in the blocklist and extracting embedded IPv4s for validation.

Affected products

Chartbrew Chartbrew before 5.2.1

Timeline

2026-11-06: disclosed
2026-06-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.