CVE-2026-65980

Executive Summary

CVE-2026-65980 is a SQL injection vulnerability in Chartbrew, an open-source web application that connects directly to databases and APIs to build charts. Prior to version 5.2.3, the ClickHouse protocol handler in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option, allowing crafted input to escape an intended SQL string literal. Because publicly exposed Chartbrew dashboards can reach this code path without authentication, a remote, unauthenticated attacker can execute arbitrary ClickHouse SQL — enabling data disclosure and, depending on database configuration, file access or internal network reach.

Technical Analysis

The vulnerability class is SQL injection (CWE-89) arising from improper neutralization of special elements in SQL commands. The root cause is a string-escaping defect in Chartbrew's variable-substitution layer.

Chartbrew implements a shared SQL variable binding routine, applySqlVariables(), located in server/sources/shared/sql/sql.variables.js. This function supports an escapeBackslash option that, when enabled, neutralizes backslash characters in user-supplied values before those values are interpolated into SQL statements. The ClickHouse protocol adapter — server/sources/plugins/clickhouse/clickhouse.protocol.js — calls applySqlVariables() without enabling escapeBackslash.

The consequence is specific and mechanical: Chartbrew's escaping strategy relies on quote doubling to keep a variable value inside its intended SQL string literal. Under this strategy, a user-supplied single quote is replaced or treated such that it cannot terminate the literal. However, when backslash escaping is not applied, an attacker can supply a backslash immediately preceding a quote. In SQL dialects where backslash acts as an escape character — ClickHouse inherits MySQL-compatible backslash handling — the backslash consumes the doubled-quote sequence, so the value is no longer confined to the string literal. The quote instead terminates the literal, and any SQL that follows is interpreted by the ClickHouse parser as part of the statement.

In short: the mitigations of backslash-escaping and quote-doubling are not independent, and applying only one of them is insufficient in a dialect with backslash escape semantics. Because ClickHouse's adapter skips backslash escaping, the quote-doubling safeguard is defeated by the classic \' construction (a backslash followed by a quote).

The attack surface is the Chartbrew variable-binding feature used by ClickHouse-backed charts. Any chart configured with variables and backed by a ClickHouse data source exercises this code path when it processes variable values. Critically, Chartbrew supports public dashboards, and the NVD description states that public dashboards can expose this path without authentication. That converts a normally authenticated analytics feature into an unauthenticated remote attack surface: the attacker does not need a Chartbrew account, only network reachability to a public dashboard that incorporates a ClickHouse-backed, variable-bound chart.

Successful injection yields execution of arbitrary ClickHouse SQL within the context of the database credentials configured in the Chartbrew data source connection. The blast radius therefore extends to whatever that ClickHouse user is permitted to do — reading tables, enumerating schema, and, where the database configuration permits, reading server-side files or reaching internal network resources via ClickHouse's table functions.

Two constraints bound the issue. First, exploitation requires a ClickHouse-backed chart with variable binding to exist and be reachable; a Chartbrew deployment with no ClickHouse source or no variable-bound charts presents no trigger path. Second, the depth of post-exploitation impact is dictated by the privileges of the configured ClickHouse account — a least-privilege read-only account sharply limits file and network access, while an over-privileged account widens it.

No public proof-of-concept, Nuclei template, or exploit code was identified in the supplied intelligence. The attack chain below is therefore inferred from the vulnerability class and the code paths named in the NVD description; specific payload strings are not published and are not fabricated here.

Exploitation Scenarios

The following chain is derived strictly from the NVD description. Where the description does not specify a detail, this report states so rather than inventing one.

1. Reconnaissance / target identification. The attacker identifies internet-facing Chartbrew deployments. Chartbrew is a web application, and deployments may be self-hosted on arbitrary infrastructure, so identification relies on fingerprinting the Chartbrew web interface (page titles, HTML content) via internet-scanning services or direct browsing. The attacker then locates a public dashboard. Per NVD, public dashboards can expose the vulnerable path without authentication, so the attacker specifically seeks dashboards that (a) are public and (b) contain a chart backed by a ClickHouse data source that uses variable binding. No credential acquisition is required for this stage.

2. Triggering the flaw class. The attacker interacts with the variable-bound element on the public dashboard, supplying input that reaches applySqlVariables() through the ClickHouse adapter. Because the adapter does not enable escapeBackslash, the attacker's input is not backslash-escaped. In the SQL-injection class, the attacker crafts input containing a backslash before a quote. In a dialect with backslash escape semantics, this sequence defeats quote doubling: the SQL string literal is terminated early, and trailing attacker-controlled content is parsed as SQL. The description explicitly names this mechanism — "an attacker can supply a backslash before a quote so quote doubling does not keep the value within its intended SQL string literal" — but does not publish the concrete parameter name, request shape, or endpoint. Analysts should not assume a specific HTTP parameter; the vulnerable operand is the chart variable value delivered to the ClickHouse-backed chart.

3. Payload / execution method (class level). Once the string literal is escaped, the attacker appends SQL to the injected value. Because the vulnerable operation is variable substitution into a query, the injected SQL executes as part of the generated ClickHouse statement under the chart's configured database connection. At the vulnerability-class level, this permits arbitrary ClickHouse SQL execution — for example, data-exfiltration statements expressed as ClickHouse SELECT operations. No public PoC exists, so no specific payload grammar is asserted here; the operative primitive is "attacker-controlled content escapes the literal and is parsed as SQL."

4. Post-exploitation impact. Successful exploitation executes arbitrary ClickHouse SQL. The NVD description identifies two impact directions: disclosure of data, and — "when the database configuration permits" — access to files or internal network resources. The latter is consistent with ClickHouse functionality that allows a sufficiently privileged account to read server-side files and to reach internal endpoints; whether it is achievable depends entirely on the privileges and configuration of the ClickHouse credentials Chartbrew uses. There is no evidence of lateral movement, persistence, or further Chartbrew compromise in the description; the impact is confined to what the injected SQL can reach.

Impact Assessment

Confidentiality (High). Arbitrary ClickHouse SQL execution directly enables reading database contents, including tables the chart was never intended to expose. A public, unauthenticated attack path raises the exposure: any data reachable by the configured ClickHouse account is potentially readable by an unauthenticated internet user.

Integrity (Low, context-dependent). The description centers on disclosure, but arbitrary SQL execution in a dialect generally permits data modification if the configured account holds write privileges. The precise integrity impact is configuration-dependent; the description emphasizes disclosure and file/network access rather than confirmed data tampering.

Availability (None asserted). The description does not indicate destructive or denial-of-service impact; the injection primitive is described in terms of disclosure and resource access.

Blast radius. Scoped to the Chartbrew deployment and the ClickHouse data source it is configured to reach. The strongest escalation is via the configured ClickHouse account: least-privilege credentials narrow the impact; over-privileged credentials can extend it to file reads and internal network reach, turning a web-app flaw into an internal-network foothold. The unauthenticated nature of public dashboards broadens the population of potential attackers to anyone with network access to such a deployment. Environments running public Chartbrew dashboards over ClickHouse data sources are the highest priority.

Detection Guidance

Because no public PoC or exploit signature exists, detections below target the vulnerability class: malformed backslash-quote sequences in chart-variable input, anomalous ClickHouse query structure, and unexpected outbound activity from the Chartbrew host.

Sigma Rule

title: Chartbrew ClickHouse SQL Injection Attempt (CVE-2026-65980)
id: 3f6c9a2e-7b41-4d0e-9a1c-5c2b8e6f1d90
status: experimental
description: Detects backslash-before-quote sequences in HTTP requests targeting Chartbrew chart-variable endpoints, consistent with ClickHouse string-literal escape attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65980
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_uri:
    cs-uri-stem|contains:
      - '/chart'
      - '/dashboard'
  selection_payload:
    cs-uri-query|contains:
      - "\\'"
      - '%5C%27'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate data entry containing a backslash followed by an apostrophe
level: high

YARA Rule

rule CVE_2026_65980_Chartbrew_ClickHouse_SQLi
{
    meta:
        description = "Detects backslash-escaped quote sequences indicative of ClickHouse SQL injection attempts against Chartbrew (CVE-2026-65980)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65980"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $bsq1 = "\\'" ascii
        $bsq2 = "\\'" wide
        $enc1 = "%5C%27" ascii nocase
        $enc2 = "%5c%27" ascii nocase

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65980 Chartbrew ClickHouse SQL Injection Attempt (backslash-quote)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"%5C%27"; nocase; reference:cve,2026-65980; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65980; classtype:web-application-attack; sid:2026659800; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri.path, "/chart*") or wildcard(http.request.uri.path, "/dashboard*")]
  [network where http.request.method in ("GET","POST") and
     (wildcard(url.query, "*\\'*") or wildcard(url.query, "*%5C%27*"))]

Splunk SPL Query

index=web
| eval payload = coalesce(uri_query, url, request)
| where match(payload, "(?i)(\\\\'|%5c%27)")
| where match(uri_path, "(?i)/(chart|dashboard)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, payload
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="web,chartbrew,sqli,">
  <rule id="100950" level="10">
    <if_sid>31100</if_sid>
    <url>%5C%27</url>
    <description>CVE-2026-65980: Chartbrew ClickHouse SQL injection attempt (backslash-escaped quote in request)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_65980,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states the issue is fixed in Chartbrew 5.2.3, but no vendor advisory URL, commit reference, or patch artifact was supplied by any tracked source; the fix is therefore asserted by the description only and cannot be independently confirmed from the data provided. Treat detection and mitigation as the near-term control until the fix is verified.

1. Immediate mitigations.

• Remove public exposure of any Chartbrew dashboards that contain ClickHouse-backed, variable-bound charts. If public dashboards must remain available, ensure none of them use variables against a ClickHouse source.
• Where the vulnerable path cannot be removed, place the deployment behind authentication and network segmentation so public dashboards are not reachable by untrusted clients.
• Restrict egress and file access available to the Chartbrew host and its ClickHouse data source to reduce the file-read / internal-network impact if the flaw is triggered.
• Apply the ClickHouse account hardening below immediately — this bounds post-exploitation impact even before a fix is available.

2. Patch / upgrade steps.

• Upgrade Chartbrew to version 5.2.3, the version identified by NVD as containing the fix. Because patch confidence is 0/4 and no vendor artifact was supplied, verify the fix directly in a staging deployment: confirm the ClickHouse adapter now invokes applySqlVariables() with escapeBackslash enabled, or that variable substitution no longer permits the backslash-quote escape sequence. Do not assume remediation without testing.
• Prior to upgrading, back up Chartbrew configuration and database connection details to ensure a clean rollback path.

3. Long-term hardening.

• Enforce least privilege on every Chartbrew data-source credential, especially ClickHouse accounts. Remove file-system and network functions from accounts that only need query access; a read-only, table-scoped account eliminates most of the post-exploitation impact described by NVD.
• Migrate variable binding from string interpolation to parameterized queries wherever the underlying client supports it. Escaping multiple special characters independently (both backslashes and quotes) is inherently error-prone; parameterization removes the escaping problem entirely.
• Inventory all publicly accessible dashboards and require authentication by default; treat any data-source-connected public dashboard as an internet-facing attack surface and include it in exposure reviews.
• Add the Sigma/YARA/IDS/EDR detections above to monitoring so attempts against any remaining exposed instances are visible, and alert on anomalous ClickHouse query structure or unexpected outbound connections originating from the Chartbrew host.
• Track the vendor repository and advisory channels for the 5.2.3 release notes and any published commit, so patch confidence can be raised from 0/4 once a verifiable artifact exists.

References

• NVD — CVE-2026-65980: https://nvd.nist.gov/vuln/detail/CVE-2026-65980
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection"): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Chartbrew project repository and release notes (verify 5.2.3 fix): https://github.com/chartbrew/chartbrew
• ClickHouse SQL reference on escape sequences and string literals (for validator hardening): https://clickhouse.com/docs/en/sql-reference

No CISA KEV entry, public PoC, Nuclei template, or exploit code was identified in the supplied intelligence. There is no evidence in the provided data of threat actor exploitation in the wild.