CVE-2026-61743

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2

Description An authenticated user capable of creating or testing API connections can exploit a DNS rebinding condition. This occurs because the validateOutboundUrl() function in server/modules/safeRequest.js resolves and validates a target hostname, but the request-promise library performs a separate DNS resolution for the actual connection. By controlling the target DNS name, an attacker can provide a public address during validation and a private address during the request, bypassing protections in server/modules/outboundTargetPolicy.js. This can lead to the exposure of internal services, localhost resources, or cloud metadata endpoints. DNS rebinding is a technique used to bypass the Same-Origin Policy by changing the IP address associated with a domain name between the time of validation and the time of use.

Recommendations Update to version 5.2.2.