CVE-2026-69128 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Chartbrew 5.2.2 has an AI query tool whose PostgreSQL SQL blocklist misses sibling file functions and double-quoted function names, so generated SQL can call them. A user with an elevated Chartbrew role can then have PostgreSQL read server files, with absolute paths reachable for superuser or pg_read_server_files roles.
first public Sep 20, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Chartbrew with AI features enabled and connect it to PostgreSQL databases whose roles can call server-side file functions. Exposure also requires an Owner or Admin using the AI query tool, and a non-superuser is limited to PGDATA-relative paths. Teams on 5.2.3 or later, or with AI features off or no PostgreSQL connections, can skip it.
Not affected if ai-features-disabled, no-postgresql-connections, version-5.2.3-or-later
Who cares ai-query-tool, chartbrew, postgresql, self-hosted
5.2.2 or earlier.5.2.3.Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.