{"id":"CVE-2026-69128","kind":"vulnerability","aliases":["CVE-2026-69128"],"related":[],"title":"Chartbrew: AI SQL blocklist bypass lets PostgreSQL read server files","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.","summary":"Chartbrew 5.2.2 has an AI query tool whose PostgreSQL SQL blocklist misses sibling file functions and double-quoted function names, so generated SQL can call them. A user with an elevated Chartbrew role can then have PostgreSQL read server files, with absolute paths reachable for superuser or pg_read_server_files roles.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-query-tool","ai-tooling","chartbrew","postgresql","self-hosted"],"not_affected_if":["ai-features-disabled","no-postgresql-connections","version-5.2.3-or-later"],"how_to_check":"- Check that the Chartbrew version is `5.2.2` or earlier.\n- Check whether AI features are enabled in Chartbrew.\n- Check whether any AI-enabled PostgreSQL connection uses a database role that can call server-side file functions, such as a superuser or a role with pg_read_server_files.","fix":"- Chartbrew: upgrade to `5.2.3`.","status":"open","published_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:33+00:00","triaged_at":"2026-11-06T22:45:01+00:00","updated_at":"2026-11-06T22:45:01+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-06T22:45:01Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: upgrade to `5.2.3`.","reach":"internet","title":"Chartbrew: AI SQL blocklist bypass lets PostgreSQL read server files","impact":"medium","summary":"Chartbrew 5.2.2 has an AI query tool whose PostgreSQL SQL blocklist misses sibling file functions and double-quoted function names, so generated SQL can call them. A user with an elevated Chartbrew role can then have PostgreSQL read server files, with absolute paths reachable for superuser or pg_read_server_files roles.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["chartbrew","postgresql","self-hosted","ai-query-tool"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Superuser-level database role reads arbitrary server files","analyst_note":"","how_to_check":"- Check that the Chartbrew version is `5.2.2` or earlier.\n- Check whether AI features are enabled in Chartbrew.\n- Check whether any AI-enabled PostgreSQL connection uses a database role that can call server-side file functions, such as a superuser or a role with pg_read_server_files.","plain_action":"","needs_analyst":false,"not_affected_if":["ai-features-disabled","no-postgresql-connections","version-5.2.3-or-later"],"who_is_affected":"Teams that self-host Chartbrew with AI features enabled and connect it to PostgreSQL databases whose roles can call server-side file functions. Exposure also requires an Owner or Admin using the AI query tool, and a non-superuser is limited to PGDATA-relative paths. Teams on 5.2.3 or later, or with AI features off or no PostgreSQL connections, can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001324,"input_tokens":4526,"output_tokens":1743,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-69128':13A,16A '5.2.2':30B,106C '5.2.3':255C 'absolut':71B,224C 'admin':146C 'ai':2A,18B,22B,33B,108C,133C,150C,200C 'ai-en':149C 'ai-query-tool':17B 'ai-tool':21B 'allow':185C 'api':97C 'applic':89C 'blocklist':4A,39B,110C,141C 'bypass':5A,192C 'call':54B,158C 'caus':165C 'chart':104C 'chartbrew':1A,24B,29B,61B,82C,211C 'connect':92C,153C 'creat':103C 'cve':11A,14A 'data':101C 'databas':95C,155C 'deni':126C,179C 'denylist':194C 'direct':93C 'doubl':46B,121C,177C,188C 'double-quot':45B,120C,176C,187C 'elev':60B,210C 'enabl':151C,204C 'express':196C 'fail':117C 'featur':201C 'file':10A,42B,69B,80B,162C,220C,227C 'filesystem':114C 'fix':253C 'form':124C 'function':43B,48B,115C,127C,163C,173C,180C,183C,190C 'generat':51B,166C 'host':28B 'identifi':123C,191C 'let':6A 'limit':240C 'match':119C 'miss':40B 'must':202C,208C 'name':49B 'non':237C 'non-superus':236C 'omit':111C 'open':86C 'open-sourc':85C 'os':232C 'owner':144C 'path':72B,225C 'pg':77B,217C 'pgdata':247C 'pgdata-rel':246C 'postgresql':7A,25B,37B,66B,113C,137C,152C,199C,214C,231C 'privileg':212C 'queri':19B,34B,134C 'quot':47B,122C,178C,189C 'reach':198C 'reachabl':73B 'read':8A,67B,78B,218C 'readabl':228C 'regular':195C 'relat':248C 'remain':184C 'resolv':223C 'role':62B,81B,156C,221C 'scope':249C 'self':27B 'self-host':26B 'server':9A,68B,79B,160C,219C 'server-sid':159C 'sibl':41B,112C,172C,182C 'side':161C 'sourc':87C,244C 'source-st':243C 'sql':3A,38B,52B,109C,139C,167C 'sql-valid':138C 'state':245C 'superus':75B,215C,238C 'surfac':130C 'team':143C 'tool':20B,23B,35B,135C 'unlist':171C,181C 'use':99C,147C,169C 'user':57B,207C,233C 'valid':140C 'vulner':129C,251C 'web':88C 'whose':36B,154C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Chartbrew with AI features enabled and connect it to PostgreSQL databases whose roles can call server-side file functions. Exposure also requires an Owner or Admin using the AI query tool, and a non-superuser is limited to PGDATA-relative paths. Teams on 5.2.3 or later, or with AI features off or no PostgreSQL connections, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiquerytool","aitooling","chartbrew","medium","postgresql","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-69128':13A,16A 'ai':2A 'blocklist':4A 'bypass':5A 'chartbrew':1A 'cve':11A,14A 'file':10A 'let':6A 'postgresql':7A 'read':8A 'server':9A 'sql':3A","search_b":"'5.2.2':30B 'absolut':71B 'ai':18B,22B,33B 'ai-query-tool':17B 'ai-tool':21B 'blocklist':39B 'call':54B 'chartbrew':24B,29B,61B 'doubl':46B 'double-quot':45B 'elev':60B 'file':42B,69B,80B 'function':43B,48B 'generat':51B 'host':28B 'miss':40B 'name':49B 'path':72B 'pg':77B 'postgresql':25B,37B,66B 'queri':19B,34B 'quot':47B 'reachabl':73B 'read':67B,78B 'role':62B,81B 'self':27B 'self-host':26B 'server':68B,79B 'sibl':41B 'sql':38B,52B 'superus':75B 'tool':20B,23B,35B 'user':57B 'whose':36B","search_c":"'5.2.2':106C '5.2.3':255C 'absolut':224C 'admin':146C 'ai':108C,133C,150C,200C 'ai-en':149C 'allow':185C 'api':97C 'applic':89C 'blocklist':110C,141C 'bypass':192C 'call':158C 'caus':165C 'chart':104C 'chartbrew':82C,211C 'connect':92C,153C 'creat':103C 'data':101C 'databas':95C,155C 'deni':126C,179C 'denylist':194C 'direct':93C 'doubl':121C,177C,188C 'double-quot':120C,176C,187C 'elev':210C 'enabl':151C,204C 'express':196C 'fail':117C 'featur':201C 'file':162C,220C,227C 'filesystem':114C 'fix':253C 'form':124C 'function':115C,127C,163C,173C,180C,183C,190C 'generat':166C 'identifi':123C,191C 'limit':240C 'match':119C 'must':202C,208C 'non':237C 'non-superus':236C 'omit':111C 'open':86C 'open-sourc':85C 'os':232C 'owner':144C 'path':225C 'pg':217C 'pgdata':247C 'pgdata-rel':246C 'postgresql':113C,137C,152C,199C,214C,231C 'privileg':212C 'queri':134C 'quot':122C,178C,189C 'reach':198C 'read':218C 'readabl':228C 'regular':195C 'relat':248C 'remain':184C 'resolv':223C 'role':156C,221C 'scope':249C 'server':160C,219C 'server-sid':159C 'sibl':112C,172C,182C 'side':161C 'sourc':87C,244C 'source-st':243C 'sql':109C,139C,167C 'sql-valid':138C 'state':245C 'superus':215C,238C 'surfac':130C 'team':143C 'tool':135C 'unlist':171C,181C 'use':99C,147C,169C 'user':207C,233C 'valid':140C 'vulner':129C,251C 'web':88C 'whose':154C","first_public_at":"2026-09-20T02:46:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69128","severity":null,"published_at":"2026-11-06T22:17:59+00:00","modified_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:33+00:00","fetched_at":"2026-11-06T22:44:33+00:00","note":null}],"documents":[{"id":90789,"url":"https://github.com/chartbrew/chartbrew/commit/b83f656a8757beccba461f0f6c5abb1a25dc3b4c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90344,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90791,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jw2r-hrxg-cfgc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-20T02:46:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}