CVE-2026-68935: Critical SSRF in Chartbrew, network protection bypass

CVE-2026-68935 is an SSRF vulnerability in Chartbrew affecting versions 4.8.5 through 5.2.2. During API connection creation or update, the system accepts the allowPrivateHost field directly from authenticated user input. An administrator or operator with API connection management permissions can enable this flag to bypass protections that normally block requests to private and reserved-network addresses, thereby accessing HTTP services internal to the Chartbrew server.

The vulnerability has a CVSS score of 9.1, classified as critical. A patch is available in version 5.2.3, released shortly after discovery. No public exploit has been reported on GitHub repositories, but a post on X in the last 24 hours confirmed the critical nature of the flaw and advised upgrading to 5.2.3. The timeline between discovery, disclosure, and patch release is appropriate, reducing wildcard exploitation risk but mandating update urgency.

Administrators must prioritize upgrading to version 5.2.3 or later for all Chartbrew instances running 4.8.5-5.2.2. Check API logs for requests to private and reserved-network addresses that may indicate exploitation. Verify that API connections do not already have the allowPrivateHost flag enabled. Disabling the instance option CB_ALLOW_PRIVATE_NETWORK_CALLS alone does not protect connections with the override enabled: the per-connection allowPrivateHost field must also be disabled before upgrade, if possible.