CVE-2026-68935

Summary

Authenticated users with API connection management permissions can bypass private-network destination restrictions by enabling the internal 'allowPrivateHost' field during API connection creation or update, allowing Chartbrew to make requests to internal services reachable from the server.

Exploitability

Requires authentication and specific permissions to manage API connections; no privilege escalation needed beyond that role.

Blast radius

Successful exploitation could expose internal HTTP services to the attacker via the compromised Chartbrew server, potentially leaking credentials, configuration data, or enabling unauthorized actions depending on the targeted internal service.

Detection

Monitor for API connection creation or update requests that include the 'allowPrivateHost' field set to true in the request body; this field should never be user-controllable and its presence indicates misconfiguration or exploitation attempt.

Prioritized remediation

Upgrade to version 5.2.3 or later, which disables the 'allowPrivateHost' override and restores enforcement of network restrictions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.