PostgreSQL Query Vulnerability in Chartbrew Open-Source Web Application
CVE-2026-69128

4.6MEDIUM

Key Information:

Vendor

Chartbrew

Status
Chartbrew
Vendor
CVE Published:
6 November 2026

What is CVE-2026-69128?

Chartbrew, an open-source web application that connects to databases and APIs to generate charts, has a vulnerability in its AI SQL query tool. In version 5.2.2, the SQL-validation blocklist failed to include certain sibling PostgreSQL filesystem functions and incorrectly processed double-quoted identifiers. This flaw can allow users with elevated permissions to execute unauthorized SQL commands through the AI-enabled PostgreSQL connection, potentially leading to unauthorized data access or manipulation. This vulnerability has been addressed in version 5.2.3.

Affected Version(s)

chartbrew >= 5.2.2, < 5.2.3

References

https://github.com/chartbrew/chartbrew/security/advisorie...
x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/commit/b83f656a875...
x_refsource_MISC
https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3
x_refsource_MISC

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.