{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3 · updates",
  "home_page_url": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026",
  "feed_url": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026/feed.json",
  "description": "NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets.",
  "language": "en",
  "_pwn": {
    "slug": "chartbrew-default-secret-sqli-ato-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-11-06-8b26f4ac",
      "url": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-11-06-8b26f4ac",
      "title": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches.",
      "content_text": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-85295",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85295",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-09-06-b173b542",
      "url": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-09-06-b173b542",
      "title": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure).",
      "content_text": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure).\n\nSource: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797",
      "date_published": "2026-09-06T00:00:00.000Z",
      "external_url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-07-19-515fb351",
      "url": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-07-19-515fb351",
      "title": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards.",
      "content_text": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards.\n\nSource: https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3",
      "date_published": "2026-07-19T00:00:00.000Z",
      "external_url": "https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-07-06-68b41671",
      "url": "https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-07-06-68b41671",
      "title": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: GitHub publishes GHSA-4wj7-9gq7-mrr2 (unauthenticated SQLi via dashboard filter substitution) and GHSA-6m7q-jmp7-3vw8 (NAT64 SSRF in outbound URL guard); fixed in Chartbrew 5.2.1.",
      "content_text": "Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: GitHub publishes GHSA-4wj7-9gq7-mrr2 (unauthenticated SQLi via dashboard filter substitution) and GHSA-6m7q-jmp7-3vw8 (NAT64 SSRF in outbound URL guard); fixed in Chartbrew 5.2.1.\n\nSource: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2",
      "date_published": "2026-07-06T00:00:00.000Z",
      "external_url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2",
      "tags": [
        "critical"
      ]
    }
  ]
}