CVE-2026-30232

OVERVIEW CVE-2026-30232 is a Server-Side Request Forgery (SSRF) vulnerability in Chartbrew, an open-source web application for creating data visualizations from databases and APIs. Versions prior to 4.8.5 allow authenticated users to create API data connections pointing to arbitrary URLs. The application's use of request-promise to fetch these URLs without IP address validation enables attackers to access internal networks and cloud metadata endpoints that should be restricted from external access. SEVERITY This vulnerability carries a CRITICAL CVSS 3.1 score of 9.6, reflecting a network-based attack vector with low complexity and no user interaction required. While exploitation requires valid user authentication, the attack's scope is changed, indicating potential impact beyond the vulnerable component. The threat actor gains high-level confidentiality and integrity access to internal systems and sensitive cloud metadata, though availability is not directly compromised. The FAUCET risk score of 55.0 indicates elevated concern in the threat landscape. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. The EPSS score of 0.00035 is lower than the majority of published CVEs, suggesting limited real-world exploitation activity to date. However, organizations running unpatched versions remain at risk and should prioritize updating to Chartbrew 4.8.5 or later to eliminate this critical exposure.