CVE-2026-30232: Depomo Chartbrew SSRF Vulnerability

CVE-2026-30232 Overview

CVE-2026-30232 is a Server-Side Request Forgery (SSRF) vulnerability in Chartbrew, an open-source web application designed to connect directly to databases and APIs for chart creation. Prior to version 4.8.5, the application allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling attackers to target internal networks and cloud metadata endpoints.

Critical Impact
Authenticated attackers can leverage this SSRF vulnerability to access internal services, cloud provider metadata endpoints (such as AWS IMDSv1), and sensitive internal network resources that are otherwise inaccessible from external networks.

Affected Products

Depomo Chartbrew versions prior to 4.8.5
All installations allowing authenticated user creation of API data connections
Self-hosted deployments without network segmentation controls

Discovery Timeline

April 10, 2026 - CVE-2026-30232 published to NVD
April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-30232

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability stems from insufficient validation of user-supplied URLs in the API data connection functionality. When authenticated users create API connections within Chartbrew, the application accepts arbitrary URLs and performs server-side HTTP requests without validating whether the target is a private network address, localhost, or cloud metadata endpoint.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches a remote resource based on user-supplied input without properly validating the destination. In this case, the request-promise library is used to fetch URLs without any filtering mechanism to block requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.1), or cloud metadata services (169.254.169.254).

Root Cause

The root cause lies in the absence of an outbound request policy that validates target URLs before the server initiates HTTP requests. The application trusted user-supplied URLs implicitly and passed them directly to the HTTP client library without implementing a deny list for private network ranges or a robust allow list approach.

Attack Vector

The attack requires authentication to the Chartbrew application. Once authenticated, an attacker can create an API data connection pointing to internal network resources. The server will then make the request on behalf of the attacker, effectively bypassing network-level access controls. Common attack scenarios include:

Accessing cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/) to steal IAM credentials
Scanning internal network services to map infrastructure
Accessing internal APIs and services not exposed to the internet
Retrieving sensitive configuration data from internal endpoints

The security patch introduces an outbound target policy module and a configuration flag to control private network access:

text

 CB_SLACK_CLIENT_SECRET=
 CB_SLACK_SIGNING_SECRET=
 
+# Private network flag
+CB_ALLOW_PRIVATE_NETWORK_CALLS=false
+
 ########################################
 
 #### DEVELOPMENT VARS ####

Source: GitHub Commit Change

The patch also integrates an outbound policy validation module into the API routes:

javascript

 const alertController = require("../controllers/AlertController");
 const getEmbeddedChartData = require("../modules/getEmbeddedChartData");
 const db = require("../models/models");
+const {
+  isOutboundPolicyError,
+  serializeOutboundPolicyError,
+} = require("../modules/outboundTargetPolicy");
 const settings = process.env.NODE_ENV === "production" ? require("../settings") : require("../settings-dev");
 
 const apiLimiter = (max = 10) => {

Source: GitHub Commit Change

Detection Methods for CVE-2026-30232

Indicators of Compromise

Outbound HTTP requests from the Chartbrew server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
Requests to cloud metadata endpoints (169.254.169.254) originating from the application server
Unusual API data connection configurations pointing to localhost or internal hostnames
Unexpected network connections from the Chartbrew container or process to infrastructure management endpoints

Detection Strategies

Monitor application logs for API connection creation events with suspicious target URLs containing private IP addresses or metadata endpoints
Implement network-level monitoring for outbound connections from the Chartbrew server to RFC 1918 address space
Review audit logs for authenticated users creating multiple API connections in rapid succession, which may indicate reconnaissance activity
Deploy web application firewall (WAF) rules to detect SSRF patterns in request parameters

Monitoring Recommendations

Enable detailed logging for all API data connection creation and modification events
Configure alerting for any outbound requests from the application tier to cloud metadata services
Implement network segmentation monitoring to detect lateral movement attempts from the Chartbrew server
Establish baseline patterns for legitimate API connections and alert on deviations

How to Mitigate CVE-2026-30232

Immediate Actions Required

Upgrade Chartbrew to version 4.8.5 or later immediately
Review existing API data connections for any suspicious configurations targeting internal resources
Audit authentication logs to identify potentially compromised accounts that may have been used to exploit this vulnerability
Implement network-level controls to restrict the Chartbrew server's ability to reach internal services

Patch Information

The vulnerability has been fixed in Chartbrew version 4.8.5. The patch introduces an outbound target policy module (outboundTargetPolicy) that validates destination URLs before making HTTP requests. Additionally, a new environment variable CB_ALLOW_PRIVATE_NETWORK_CALLS has been added, which defaults to false to block requests to private network ranges.

For detailed patch information, refer to the GitHub Security Advisory GHSA-p4rg-967r-w4cv and the security commit.

Workarounds

If immediate upgrade is not possible, implement network-level controls using firewall rules to prevent the Chartbrew server from accessing internal networks and cloud metadata endpoints
Deploy a reverse proxy with URL filtering capabilities to inspect and block outbound requests to private IP ranges
Restrict user permissions to limit who can create API data connections until the patch can be applied
Consider placing the Chartbrew application in an isolated network segment with no access to sensitive internal resources

bash

# Example iptables rules to block SSRF to internal networks (apply on Chartbrew server)
# Block access to common internal ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
# Block cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP
# Block localhost access for SSRF
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP