CVE-2026-30232 is a critical server-side request forgery flaw (CVSS 9.6) in Chartbrew, the open source charting app. Signed-in users can create API connections with any URL, and the server fetches it without checking the address. NVD says the fix is 4.8.5, but the advisory page should be checked.
What's affected
The NVD record says versions before 4.8.5 are affected and that 4.8.5 fixes the issue. The GitHub advisory page lists affected versions as 4.0.0 and below and shows no patched version, so the two sources do not line up cleanly. Check the advisory and the project's releases for your exact version before you decide you are safe.
The exposure requires an account. The advisory says any team member can create a connection.
How to check if you're exposed
Find your Chartbrew version from the app footer or from package.json in the server directory:
grep '"version"' package.json
docker ps --format '{{.Image}}' | grep -i chartbrew
Then review who has accounts. Because the flaw needs a signed-in user, check team membership and whether sign-up is open. On a cloud host, find out whether the instance metadata service is reachable from the Chartbrew server and whether it requires a session token.
What to do now
- Upgrade Chartbrew to 4.8.5 or later, and read the advisory for any newer guidance.
- Review team members and remove accounts you do not recognise, and close open registration if you do not need it.
- On cloud hosts, require the hardened metadata service mode where your provider offers one, and block the metadata address from application containers where you can.
- Add egress rules so the Chartbrew server can only reach the data sources it needs.
- Review stored connections for URLs pointing at private or link-local addresses. Run the free in-browser dependency scan at https://gold.safeguard.sh/scan to see whether the affected package is in your lockfile or SBOM.
Why it matters
This is CWE-918, server-side request forgery. The advisory says the server fetches user-supplied connection URLs with the request-promise library and applies no IP validation, no private range filtering and no block on cloud metadata addresses. A user can therefore use the server as a proxy into networks the user cannot reach directly.
The advisory describes theft of cloud instance credentials and access to internal services as the main impacts. It is rated with a changed scope in the CVSS vector, which reflects that the damage goes beyond the app itself. Tools whose job is to connect to arbitrary data sources face this problem by design, so egress controls matter as much as the patch. The record does not mark this as exploited in the wild.
Quick check
Does an attacker need an account?
Yes. The vector requires low privileges, and the advisory says any team member can create connections.
Why do the sources disagree on the fix?
The NVD record says 4.8.5, while the advisory page shows no patched version. Verify against the project's releases.
Sources
Last reviewed: 19 October 2026.
