CVE-2026-54589

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, the outbound URL guard recognized ordinary IPv4, IPv6, and IPv4-mapped IPv6 destinations but did not recognize IPv4 addresses embedded in NAT64 prefixes. The vulnerable surface is aPI Data Connection outbound requests routed through server/modules/outboundTargetPolicy.js. An authenticated user with permission to create or edit an API connection supplies an attacker-controlled hostname or redirect whose DNS answer is a NAT64 address embedding a private or link-local IPv4 destination. The policy treated the NAT64 address as public; a NAT64 gateway then translated it to the embedded private IPv4 address after validation. The bypass requires a NAT64/DNS64 deployment path and connection-management privileges. IPv4-only deployments are not affected by this specific bypass. The attacker can read responses from 169.254.169.254 cloud metadata and arbitrary internal IPv4 hosts and ports reachable through the NAT64 gateway. This issue is fixed in version 5.2.1.

• CWE-918

• https://github.com/chartbrew/chartbrew/commit/8cfac8076bb0001b1571d93ef923698f53767751
• https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8

Published

Nov 6, 2026

Last Modified

Nov 11, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54583mport is the MidnightBSD Package Manager. Prior to 2.7.8, li…8.3
• CVE-2026-54584mport is the MidnightBSD Package Manager. mport before 2.7.8…5.3
• CVE-2026-54585mport is the MidnightBSD Package Manager. Prior to 2.7.8, cr…6
• CVE-2026-54586mport is the MidnightBSD Package Manager. Prior to 2.7.8, th…6
• CVE-2026-54587mport is the MidnightBSD Package Manager. Prior to 2.7.8, di…5.8
• CVE-2026-54588Poweradmin is a web-based DNS administration tool for PowerD…9.6
• CVE-2026-5459The User Frontend: AI Powered Frontend Posting, User Directo…5.3
• CVE-2026-54590AsyncSSH is a Python package which provides an asynchronous …5.9
• CVE-2026-54591AsyncSSH is a Python package which provides an asynchronous …8.1
• CVE-2026-54592Oj (Optimized JSON) is a JSON parser and Object marshaller p…7.5
• CVE-2026-54593Pterodactyl is a free, open-source game server management pa…8.1
• CVE-2026-54594OmniBlocks is a monorepo for the OmniBlocks project. Prior t…5.3