CVE-2026-65980: Chartbrew ClickHouse SQLI Vulnerability

CVE-2026-65980 Overview

CVE-2026-65980 is a SQL injection vulnerability in Chartbrew, an open-source web application that connects to databases and APIs to build charts. Versions prior to 5.2.3 fail to escape backslashes when applying SQL variables in the ClickHouse protocol handler. An attacker can supply a backslash before a quote to break out of an intended SQL string literal and execute arbitrary ClickHouse SQL. Public dashboards expose the vulnerable code path without authentication, allowing unauthenticated data disclosure and, depending on ClickHouse configuration, access to local files or internal network resources.

Critical Impact
Unauthenticated attackers can execute arbitrary ClickHouse SQL against Chartbrew instances exposing public dashboards backed by ClickHouse data sources.

Affected Products

Chartbrew versions prior to 5.2.3
Chartbrew instances configured with ClickHouse data sources
Chartbrew deployments exposing public dashboards with variable binding

Discovery Timeline

2026-09-21 - CVE-2026-65980 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-65980

Vulnerability Analysis

The vulnerability resides in server/sources/plugins/clickhouse/clickhouse.protocol.js, which calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. The variable interpolation logic doubles single quotes to prevent breakout from string literals. However, ClickHouse also interprets backslashes as escape characters within string literals. A trailing backslash before the doubled quote neutralizes the quote and allows subsequent characters to be interpreted as SQL code rather than literal data. This is a classic SQL injection pattern classified under CWE-89.

Root Cause

The root cause is incomplete input sanitization. The shared SQL variable module supports an escapeBackslash flag for backends where backslash acts as an escape character inside string literals. The ClickHouse plugin invoked this module without setting the flag, leaving quote doubling ineffective against payloads containing backslash-quote sequences.

Attack Vector

An attacker sends a crafted variable value to a public Chartbrew dashboard bound to a ClickHouse chart. The value contains a backslash immediately followed by a quote (\'), which escapes the closing quote generated by the variable substitution routine. Trailing SQL is then executed by the ClickHouse server. When the ClickHouse configuration permits, this can extend beyond data disclosure to reading local files via file() table functions or reaching internal network resources through url() and remote() functions.

javascript

// Patch from server/sources/plugins/clickhouse/clickhouse.protocol.js
module.exports = {
  applyVariables({ dataRequest, variables }) {
-    return applySqlVariables(dataRequest, variables);
+    return applySqlVariables(dataRequest, variables, { escapeBackslash: true });
  },
  applyUploadedFiles,
  generateQuery,
};

Source: GitHub Commit 5f95d07

Detection Methods for CVE-2026-65980

Indicators of Compromise

Dashboard variable values containing backslash-quote sequences (\' or \") in HTTP request bodies or query strings targeting Chartbrew endpoints.
ClickHouse query logs showing unexpected SELECT, UNION, file(), url(), or remote() calls originating from Chartbrew service accounts.
Outbound network connections from ClickHouse hosts to unexpected internal or external destinations.

Detection Strategies

Inspect Chartbrew access logs for public dashboard requests containing suspicious variable payloads with backslash escape characters.
Enable and review ClickHouse query_log for anomalous queries containing table functions such as file, url, remote, or mysql invoked by the Chartbrew user.
Correlate web request payloads with resulting ClickHouse queries to identify variable values that produce syntactically expanded SQL.

Monitoring Recommendations

Alert on ClickHouse queries that reference file or network table functions when the source is a reporting or BI account.
Baseline the shape of queries generated by Chartbrew dashboards and flag deviations, especially unions and stacked statements.
Monitor egress traffic from ClickHouse servers to catch SSRF-style probes of internal network resources.

How to Mitigate CVE-2026-65980

Immediate Actions Required

Upgrade Chartbrew to version 5.2.3 or later, which sets escapeBackslash: true when invoking applySqlVariables().
Audit all public dashboards backed by ClickHouse and temporarily disable them until the patch is applied.
Rotate any credentials or tokens accessible through the ClickHouse account used by Chartbrew if exploitation is suspected.

Patch Information

The fix is available in Chartbrew Release v5.2.3 and details are documented in GitHub Security Advisory GHSA-5jgv-45cw-hc53. The one-line change enables backslash escaping when applying SQL variables in the ClickHouse plugin.

Workarounds

Restrict the Chartbrew ClickHouse user to read-only access on a minimal set of tables and disable file and URL table functions in ClickHouse settings.
Disable public dashboards or require authentication for any dashboard bound to a ClickHouse data source until upgraded.
Place Chartbrew behind a web application firewall rule that blocks backslash-quote sequences in dashboard variable parameters.

bash

# Upgrade Chartbrew to the patched release
git fetch --tags
git checkout v5.2.3
npm install
npm run build

# Optional ClickHouse hardening: restrict dangerous table functions for the Chartbrew user
# users.xml
#   <chartbrew>
#     <readonly>1</readonly>
#     <allow_ddl>0</allow_ddl>
#     <function_restrictions>
#       <disable>file,url,remote,mysql,postgresql</disable>
#     </function_restrictions>
#   </chartbrew>