CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs

What is CVE-2026-30232?

CVE-2026-30232 is a high-severity server-side request forgery vulnerability in chartbrew, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

Weakness: CWE-918

Which versions are affected by CVE-2026-30232?

It affects 1 product.

Products include Depomo Chartbrew.

How do I fix CVE-2026-30232?

No fix has been published for CVE-2026-30232 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-30232 being exploited?

There is no known exploitation of CVE-2026-30232 in the wild and no public exploit code.

Other vulnerabilities in chartbrew

• CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API High 8.8
• CVE-2026-27005 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) High 8.8
• CVE-2026-27603 Missing authorization in chartbrew High 8.7
• CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` High 7.7
• CVE-2026-25887 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p4rg-967r-w4cv.