Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3 · updates https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets. en Fri, 06 Nov 2026 00:00:00 GMT Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches. https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-11-06-8b26f4ac Fri, 06 Nov 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-85295">Source</a></p> Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure). https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-09-06-b173b542 Sun, 06 Sep 2026 00:00:00 GMT critical <p><a href="https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797">Source</a></p> Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards. https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-07-19-515fb351 Sun, 19 Jul 2026 00:00:00 GMT critical <p><a href="https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3">Source</a></p> Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3: GitHub publishes GHSA-4wj7-9gq7-mrr2 (unauthenticated SQLi via dashboard filter substitution) and GHSA-6m7q-jmp7-3vw8 (NAT64 SSRF in outbound URL guard); fixed in Chartbrew 5.2.1. https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026#2026-07-06-68b41671 Mon, 06 Jul 2026 00:00:00 GMT critical <p><a href="https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2">Source</a></p>