Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3

Chartbrew (chartbrew/chartbrew)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets.

Why this severity: CVE-2026-85295 and CVE-2026-54349 both CVSS 9.8 (NVD/GitHub 2026-11-06); CVE-2026-86005 critical unauthenticated BullMQ board; cross-tenant takeover CVE-2026-85712 CVSS 8.8; patches shipped in 5.2.1 (Jul) and 5.2.3 (Jul) before NVD IDs

Started
Jul 6, 2026
CVEs
CVE-2026-85295CVE-2026-54349CVE-2026-85712CVE-2026-85708CVE-2026-85726CVE-2026-85736CVE-2026-86005CVE-2026-54589

Follow this incident

Discuss on X ↗

Affected

  • Chartbrew <= 5.2.0 for CVE-2026-54349 / CVE-2026-54589
  • Chartbrew <= 5.2.2 for CVE-2026-85295 / 85712 / 85708 / 85726 / 85736 / 86005
  • Default CB_SECRET installs (source setup / repo docker-compose) most exposed for JWT/share-token forgeries

Fixed in

  • Chartbrew 5.2.1 (SQLi CVE-2026-54349, NAT64 SSRF CVE-2026-54589)
  • Chartbrew 5.2.3 (ATO, cross-tenant, share tokens, Mongo NoSQLi, file delete, BullMQ auth)

Timeline4

  1. NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches.

  2. GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure).

  3. Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards.

  4. GitHub publishes GHSA-4wj7-9gq7-mrr2 (unauthenticated SQLi via dashboard filter substitution) and GHSA-6m7q-jmp7-3vw8 (NAT64 SSRF in outbound URL guard); fixed in Chartbrew 5.2.1.

Advisories12

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo