Chartbrew is an open‑source analytics platform that allows users to create charts from external APIs. Before version 5.2.1 the outbound URL guard rejected only standard IPv4 and IPv6 addresses, but failed to recognize IPv4 addresses embedded inside NAT64 prefixes. An authenticated user with permission to create or edit an API data connection can supply a hostname whose DNS resolution returns a NAT64 address that embeds a private or link‑local IPv4 destination. The guard treats the NAT64 address as public, and the NAT64 gateway translates it to the private host after validation, enabling the attacker to read responses from internal resources such as 169.254.169.254 or other reachable internal IPv4 hosts and ports. This flaw does not apply to purely IPv4 deployments.

Chartbrew versions prior to 5.2.1 are affected. The vulnerability exists in the outboundTargetPolicy.js module that validates URLs for API data connections. Any deployment using the default outbound policy and lacking the patch is susceptible. The affected product is the Chartbrew application, any instance of which must be examined for API connection management capabilities. No other vendors or products are listed.

The CVSS score of 7 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exploitation probability is unknown from those metrics. Exploitability requires a NAT64/DNS64 deployment path and the attacker must have permission to create or edit an API connection; otherwise the bypass is not possible. When the conditions are met, the attacker can cause server‑side request forgery that reaches internal metadata endpoints or arbitrary private hosts, potentially exposing sensitive data or enabling further lateral movement.