Out-of-Bounds DNS Resolution in Chartbrew Web Application
CVE-2026-54589

7HIGH

Key Information:

Vendor

Chartbrew

Status
Chartbrew
Vendor
CVE Published:
6 November 2026

What is CVE-2026-54589?

Chartbrew, an open-source web application for data visualization, has a vulnerability that affects its outbound URL guard functionality. This issue arises in versions prior to 5.2.1, where the application fails to recognize IPv4 addresses embedded within NAT64 prefixes. As a result, an authenticated user with the capability to create or modify API connections may inadvertently expose the system to risk by employing attacker-controlled hostnames. The application treats NAT64 addresses as public, allowing for potential unauthorized access to sensitive responses, including cloud metadata and internal IP addresses reachable through the NAT64 gateway. This flaw emphasizes the necessity of updating to version 5.2.1 or later to ensure secure API data connections.

Affected Version(s)

chartbrew < 5.2.1

References

https://github.com/chartbrew/chartbrew/security/advisorie...
x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/commit/8cfac8076bb...
x_refsource_MISC
https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.