CVE-2026-54589

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.1

Description The outbound URL guard fails to recognize IPv4 addresses embedded in NAT64 prefixes, which are used to allow IPv6-only clients to communicate with IPv4-only servers. An authenticated user with connection-management privileges can provide a hostname or redirect that resolves to a NAT64 address containing a private or link-local IPv4 destination. Because the policy incorrectly treats the NAT64 address as public, a NAT64 gateway translates it to the internal IPv4 address after validation. This allows an attacker to read responses from cloud metadata at 169.254.169.254 and other internal IPv4 hosts and ports reachable via the gateway. The issue affects API Data Connection outbound requests routed through server/modules/outboundTargetPolicy.js in environments using a NAT64/DNS64 deployment path.

Recommendations Update to version 5.2.1.