Is CVE-2026-68935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68935 being exploited in the wild.

How severe is CVE-2026-68935?

Critical severity, with a CVSS score of 9.1, published 6 November 2026.

How is CVE-2026-68935 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-68935?

Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68935: Chartbrew API connection private host bypass

CVE-2026-68935 · Severity: critical · CVSS 9.1 · Published 2026-11-06

Chartbrew is an open-source web charting application that connects to databases and APIs to visualize data. An authenticated user with permission to manage API connections can bypass network security restrictions to access internal HTTP services on the Chartbrew server's network. This could allow an attacker to gather information from or interact with internal systems that should not be reachable, such as metadata services or internal APIs.

Technologies: Chartbrew. Vendors: Chartbrew.

Quick answers

Is CVE-2026-68935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68935 being exploited in the wild.
How severe is CVE-2026-68935?: Critical severity, with a CVSS score of 9.1, published 6 November 2026.
Which products and versions are affected?: Chartbrew 4.8.5 through 5.2.2.
Is there a fix for CVE-2026-68935?: Yes: fixed in 5.2.3. Until then: Upgrade to version 5.2.3 immediately. As a temporary workaround, restrict API connection management permissions to only trusted users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68935 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-68935?: Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.2.3

Upgrade to version 5.2.3 immediately. As a temporary workaround, restrict API connection management permissions to only trusted users.

Technical details

Versions 4.8.5 through 5.2.2 accept the allowPrivateHost field from user input during API connection creation and updates, bypassing private and reserved-network destination restrictions. An authenticated user with API connection management permissions can enable this field to reach internal HTTP services. The per-connection setting overrides the CB_ALLOW_PRIVATE_NETWORK_CALLS configuration option, making instance-level restrictions ineffective for connections with this override enabled.

Affected products

chartbrew Chartbrew 4.8.5 through 5.2.2

Timeline

2026-11-06: disclosed
2026-07-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.