---
id: "CVE-2026-69128"
page: "https://infrastack.ai/live/CVE-2026-69128"
kind: "vulnerability"
aliases: ["CVE-2026-69128"]
title: "Chartbrew: AI SQL blocklist bypass lets PostgreSQL read server files"
severity: "medium"
cvss: 4.6
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-query-tool", "ai-tooling", "chartbrew", "postgresql", "self-hosted"]
not_affected_if: ["ai-features-disabled", "no-postgresql-connections", "version-5.2.3-or-later"]
published_at: "2026-11-06T22:17:59+00:00"
first_seen_at: "2026-11-06T22:44:33+00:00"
updated_at: "2026-11-06T22:45:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69128", "first_seen_at": "2026-11-06T22:44:33+00:00"}]
exploit_sources: []
---

# Chartbrew: AI SQL blocklist bypass lets PostgreSQL read server files

Link for people: https://infrastack.ai/live/CVE-2026-69128 (this .md is for agents)

Chartbrew 5.2.2 has an AI query tool whose PostgreSQL SQL blocklist misses sibling file functions and double-quoted function names, so generated SQL can call them. A user with an elevated Chartbrew role can then have PostgreSQL read server files, with absolute paths reachable for superuser or pg_read_server_files roles.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check that the Chartbrew version is `5.2.2` or earlier.
- Check whether AI features are enabled in Chartbrew.
- Check whether any AI-enabled PostgreSQL connection uses a database role that can call server-side file functions, such as a superuser or a role with pg_read_server_files.

## Fix

- Chartbrew: upgrade to `5.2.3`.

## Timeline

- 2026-11-06T22:44:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-69128

## Documents

- [advisory] Vendor advisory: github.com https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jw2r-hrxg-cfgc
- [fix] Patch: github.com https://github.com/chartbrew/chartbrew/commit/b83f656a8757beccba461f0f6c5abb1a25dc3b4c
- [fix] Release notes: github.com https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3

## From the sources

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_