CVE-2026-27005 is a critical (CVSS 9.8) SQL injection in Chartbrew before version 4.8.3. An unauthenticated attacker can inject SQL into queries run against connected MySQL and PostgreSQL databases. Version 4.8.3 fixes it. Upgrade, and review the privileges of the database users Chartbrew holds.
What's affected
Chartbrew versions before 4.8.3. The record says the flaw allows reading, modifying or deleting data in the connected databases, depending on the database user's privileges. The fix is in 4.8.3.
How to check if you're exposed
Find your Chartbrew version from the package or container tag you deployed and compare it with 4.8.3. If you run it from source, check the version in package.json.
Then list the databases Chartbrew connects to and the privileges of each account it uses. That list is your blast radius if the instance was reachable before you upgraded.
What to do now
- Upgrade Chartbrew to 4.8.3 or later.
- Move the instance behind authentication or a VPN if it is public.
- Reduce each connected database account to read only access on the tables charts need.
- Review database logs for unexpected writes or deletes since the instance was exposed.
- Rotate the credentials Chartbrew stores for connected databases and APIs.
Why it matters
The weakness is CWE-89, SQL injection. Chartbrew exists to run queries against your other databases, which makes any injection flaw a gateway to those systems, not only to its own data.
The lesson for tools of this kind is simple. Give connected accounts the least privilege they need, because the application will hold the keys to everything it charts. The record does not mark this CVE as known exploited.
Quick check
Does the attacker need to log in?
The record says unauthenticated, so no.
Sources
- CVE-2026-27005 on Gold
- Release listed in the record: https://github.com/chartbrew/chartbrew/releases/tag/v4.8.3
- GitHub advisory listed in the record: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w5rh-v333-qq6c
Last reviewed: 19 October 2026.
