CVE-2026-69128

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.

• CWE-22
• CWE-184

• https://github.com/chartbrew/chartbrew/commit/b83f656a8757beccba461f0f6c5abb1a25dc3b4c
• https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jw2r-hrxg-cfgc
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jw2r-hrxg-cfgc

Published

Nov 6, 2026

Last Modified

Nov 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69119Taubyte Tau v1.1.10 contains a missing authorization vulnera…8.3
• CVE-2026-6912Improperly controlled modification of dynamically-determined…8.8
• CVE-2026-69123Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-69124Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-69125Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-69127Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-69129KubePi is a Kubernetes multi-cluster management panel. In ve…5.8
• CVE-2026-6913The Shortcodely plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-69134SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-69135SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-69136SuiteCRM is an open-source, enterprise-ready Customer Relati…7.1
• CVE-2026-69137SuiteCRM is an open-source, enterprise-ready Customer Relati…7.7