{"id":"CVE-2026-54589","kind":"vulnerability","aliases":["CVE-2026-54589"],"related":[],"title":"Chartbrew: NAT64 addresses bypass outbound URL guard, reaching internal hosts","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, the outbound URL guard recognized ordinary IPv4, IPv6, and IPv4-mapped IPv6 destinations but did not recognize IPv4 addresses embedded in NAT64 prefixes. The vulnerable surface is aPI Data Connection outbound requests routed through server/modules/outboundTargetPolicy.js. An authenticated user with permission to create or edit an API connection supplies an attacker-controlled hostname or redirect whose DNS answer is a NAT64 address embedding a private or link-local IPv4 destination. The policy treated the NAT64 address as public; a NAT64 gateway then translated it to the embedded private IPv4 address after validation. The bypass requires a NAT64/DNS64 deployment path and connection-management privileges. IPv4-only deployments are not affected by this specific bypass. The attacker can read responses from 169.254.169.254 cloud metadata and arbitrary internal IPv4 hosts and ports reachable through the NAT64 gateway. This issue is fixed in version 5.2.1.","summary":"Chartbrew's outbound URL check did not recognize IPv4 addresses embedded in NAT64 IPv6 prefixes, so a user who can create API connections can point requests at private IPv4 hosts. The attacker can read responses from cloud metadata endpoints and internal hosts reachable through the NAT64 gateway.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chartbrew","cloud-metadata","nat64","package","self-hosted"],"not_affected_if":["ipv4-only","managed-hosting","no-nat64-dns64","version-5.2.1-or-later"],"how_to_check":"- Check the Chartbrew version in use; versions before `5.2.1` are affected.\n- Confirm whether the deployment runs on a NAT64/DNS64 network path; IPv4-only deployments are not affected by this bypass.\n- Check who holds permission to create or edit API data connections.","fix":"- Chartbrew: upgrade to `5.2.1`.","status":"open","published_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:42+00:00","updated_at":"2026-11-06T21:46:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:42Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: upgrade to `5.2.1`.","reach":"network","title":"Chartbrew: NAT64 addresses bypass outbound URL guard, reaching internal hosts","impact":"medium","summary":"Chartbrew's outbound URL check did not recognize IPv4 addresses embedded in NAT64 IPv6 prefixes, so a user who can create API connections can point requests at private IPv4 hosts. The attacker can read responses from cloud metadata endpoints and internal hosts reachable through the NAT64 gateway.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chartbrew","self-hosted","nat64","cloud-metadata"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads cloud metadata and internal IPv4 service responses","analyst_note":"","how_to_check":"- Check the Chartbrew version in use; versions before `5.2.1` are affected.\n- Confirm whether the deployment runs on a NAT64/DNS64 network path; IPv4-only deployments are not affected by this bypass.\n- Check who holds permission to create or edit API data connections.","plain_action":"","needs_analyst":false,"not_affected_if":["ipv4-only","no-nat64-dns64","managed-hosting","version-5.2.1-or-later"],"who_is_affected":"Self-hosted Chartbrew instances before 5.2.1 running on IPv6 networks with NAT64/DNS64 translation, where users can create or edit API data connections. The bypass needs a NAT64 gateway that can reach internal IPv4 hosts; IPv4-only deployments are not affected by this specific bypass.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4556,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54589':13A,16A '169.254.169.254':222C '5.2.1':98C,243C 'address':3A,35B,118C,161C,176C,190C 'affect':211C 'answer':157C 'api':47B,88C,127C,145C 'applic':80C 'arbitrari':226C 'attack':57B,150C,217C 'attacker-control':149C 'authent':136C 'bypass':4A,194C,215C 'chart':95C 'chartbrew':1A,17B,26B,73C 'check':30B 'cloud':19B,62B,223C 'cloud-metadata':18B 'connect':48B,83C,129C,146C,202C 'connection-manag':201C 'control':151C 'creat':46B,94C,141C 'cve':11A,14A 'data':92C,128C 'databas':86C 'deploy':198C,208C 'destin':112C,170C 'direct':84C 'dns':156C 'edit':143C 'embed':36B,119C,162C,187C 'endpoint':64B 'fix':240C 'gateway':72B,181C,236C 'guard':7A,102C 'host':10A,25B,55B,67B,229C 'hostnam':152C 'intern':9A,66B,227C 'ipv4':34B,54B,105C,109C,117C,169C,189C,206C,228C 'ipv4-mapped':108C 'ipv4-only':205C 'ipv6':39B,106C,111C 'issu':238C 'link':167C 'link-loc':166C 'local':168C 'manag':203C 'map':110C 'metadata':20B,63B,224C 'nat64':2A,21B,38B,71B,121C,160C,175C,180C,235C 'nat64/dns64':197C 'open':77C 'open-sourc':76C 'ordinari':104C 'outbound':5A,28B,100C,130C 'packag':22B 'path':199C 'permiss':139C 'point':50B 'polici':172C 'port':231C 'prefix':40B,122C 'prior':96C 'privat':53B,164C,188C 'privileg':204C 'public':178C 'reach':8A 'reachabl':68B,232C 'read':59B,219C 'recogn':33B,103C,116C 'redirect':154C 'request':51B,131C 'requir':195C 'respons':60B,220C 'rout':132C 'self':24B 'self-host':23B 'server/modules/outboundtargetpolicy.js':134C 'sourc':78C 'specif':214C 'suppli':147C 'surfac':125C 'translat':183C 'treat':173C 'url':6A,29B,101C 'use':90C 'user':43B,137C 'valid':192C 'version':242C 'vulner':124C 'web':79C 'whose':155C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Chartbrew instances before 5.2.1 running on IPv6 networks with NAT64/DNS64 translation, where users can create or edit API data connections. The bypass needs a NAT64 gateway that can reach internal IPv4 hosts; IPv4-only deployments are not affected by this specific bypass.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chartbrew","cloudmetadata","high","nat64","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-54589':13A,16A 'address':3A 'bypass':4A 'chartbrew':1A 'cve':11A,14A 'guard':7A 'host':10A 'intern':9A 'nat64':2A 'outbound':5A 'reach':8A 'url':6A","search_b":"'address':35B 'api':47B 'attack':57B 'chartbrew':17B,26B 'check':30B 'cloud':19B,62B 'cloud-metadata':18B 'connect':48B 'creat':46B 'embed':36B 'endpoint':64B 'gateway':72B 'host':25B,55B,67B 'intern':66B 'ipv4':34B,54B 'ipv6':39B 'metadata':20B,63B 'nat64':21B,38B,71B 'outbound':28B 'packag':22B 'point':50B 'prefix':40B 'privat':53B 'reachabl':68B 'read':59B 'recogn':33B 'request':51B 'respons':60B 'self':24B 'self-host':23B 'url':29B 'user':43B","search_c":"'169.254.169.254':222C '5.2.1':98C,243C 'address':118C,161C,176C,190C 'affect':211C 'answer':157C 'api':88C,127C,145C 'applic':80C 'arbitrari':226C 'attack':150C,217C 'attacker-control':149C 'authent':136C 'bypass':194C,215C 'chart':95C 'chartbrew':73C 'cloud':223C 'connect':83C,129C,146C,202C 'connection-manag':201C 'control':151C 'creat':94C,141C 'data':92C,128C 'databas':86C 'deploy':198C,208C 'destin':112C,170C 'direct':84C 'dns':156C 'edit':143C 'embed':119C,162C,187C 'fix':240C 'gateway':181C,236C 'guard':102C 'host':229C 'hostnam':152C 'intern':227C 'ipv4':105C,109C,117C,169C,189C,206C,228C 'ipv4-mapped':108C 'ipv4-only':205C 'ipv6':106C,111C 'issu':238C 'link':167C 'link-loc':166C 'local':168C 'manag':203C 'map':110C 'metadata':224C 'nat64':121C,160C,175C,180C,235C 'nat64/dns64':197C 'open':77C 'open-sourc':76C 'ordinari':104C 'outbound':100C,130C 'path':199C 'permiss':139C 'polici':172C 'port':231C 'prefix':122C 'prior':96C 'privat':164C,188C 'privileg':204C 'public':178C 'reachabl':232C 'read':219C 'recogn':103C,116C 'redirect':154C 'request':131C 'requir':195C 'respons':220C 'rout':132C 'server/modules/outboundtargetpolicy.js':134C 'sourc':78C 'specif':214C 'suppli':147C 'surfac':125C 'translat':183C 'treat':173C 'url':101C 'use':90C 'user':137C 'valid':192C 'version':242C 'vulner':124C 'web':79C 'whose':155C","first_public_at":"2026-07-06T06:42:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54589","severity":null,"published_at":"2026-11-06T21:17:09+00:00","modified_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90312,"url":"https://github.com/chartbrew/chartbrew/commit/8cfac8076bb0001b1571d93ef923698f53767751","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90310,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90314,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-06T06:42:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}