# Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3 · pwn.watch

> NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets.

Page: https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 · generated 2026-11-06T23:06:31.252Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Chartbrew (chartbrew/chartbrew)
- Started: 2026-07-06
- CVEs: CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, CVE-2026-54589
- Affected: Chartbrew <= 5.2.0 for CVE-2026-54349 / CVE-2026-54589; Chartbrew <= 5.2.2 for CVE-2026-85295 / 85712 / 85708 / 85726 / 85736 / 86005; Default CB_SECRET installs (source setup / repo docker-compose) most exposed for JWT/share-token forgeries
- Fixed in: Chartbrew 5.2.1 (SQLi CVE-2026-54349, NAT64 SSRF CVE-2026-54589); Chartbrew 5.2.3 (ATO, cross-tenant, share tokens, Mongo NoSQLi, file delete, BullMQ auth)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026.json
- This file: https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-06: NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches. (https://nvd.nist.gov/vuln/detail/CVE-2026-85295)
- 2026-09-06: GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure). (https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797)
- 2026-07-19: Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards. (https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3)
- 2026-07-06: GitHub publishes GHSA-4wj7-9gq7-mrr2 (unauthenticated SQLi via dashboard filter substitution) and GHSA-6m7q-jmp7-3vw8 (NAT64 SSRF in outbound URL guard); fixed in Chartbrew 5.2.1. (https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2)

## Fix brief
# Security brief: Chartbrew: default CB_SECRET account takeover, unauthenticated SQLi, cross-tenant theft, BullMQ exposure — fixed in 5.2.1 / 5.2.3

Source: https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026 · status: live · severity: critical · updated Nov 6, 2026, 22:05 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
NVD published a Chartbrew advisory cluster on 2026-11-06 for issues patched earlier in v5.2.1 and v5.2.3. Critical CVE-2026-85295 (CVSS 9.8): stock source/docker-compose installs keep the shipped CB_SECRET default, so an unauthenticated attacker forges session JWTs for any user (password/2FA bypass). Critical CVE-2026-54349 (CVSS 9.8): unauthenticated SQL injection via dashboard/chart filter variable substitution on public/embedded charts (fixed in 5.2.1). High CVE-2026-85712 (CVSS 8.8): authenticated cross-tenant project takeover via caller-controlled body.team_id. Same 5.2.3 wave also covers forgeable share tokens (CVE-2026-85708), MongoDB date-variable NoSQLi (CVE-2026-85726), root-path file deletion via SSL/SSH cleanup (CVE-2026-85736), unauthenticated BullMQ admin dashboard at /apps/queues (CVE-2026-86005), and NAT64 SSRF bypass in outbound URL guards (CVE-2026-54589, fixed in 5.2.1). Upgrade to Chartbrew 5.2.3 (at least 5.2.1 for the SQLi/SSRF subset) and rotate secrets.

Severity detail: CVE-2026-85295 and CVE-2026-54349 both CVSS 9.8 (NVD/GitHub 2026-11-06); CVE-2026-86005 critical unauthenticated BullMQ board; cross-tenant takeover CVE-2026-85712 CVSS 8.8; patches shipped in 5.2.1 (Jul) and 5.2.3 (Jul) before NVD IDs

- Product: Chartbrew (chartbrew/chartbrew)
- CVE / advisory ids: CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, CVE-2026-54589

## Affected versions
- Chartbrew <= 5.2.0 for CVE-2026-54349 / CVE-2026-54589
- Chartbrew <= 5.2.2 for CVE-2026-85295 / 85712 / 85708 / 85726 / 85736 / 86005
- Default CB_SECRET installs (source setup / repo docker-compose) most exposed for JWT/share-token forgeries

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Chartbrew 5.2.1 (SQLi CVE-2026-54349, NAT64 SSRF CVE-2026-54589)
- Chartbrew 5.2.3 (ATO, cross-tenant, share tokens, Mongo NoSQLi, file delete, BullMQ auth)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
CVE IDs from NVD Received 2026-11-06 (GitHub Advisory Database), not cve.now. Patches are months old (5.2.1 / 5.2.3); page tracks the NVD publication of the Chartbrew critical cluster. Skipped CVE-2026-68933/68935/69128 — no NVD records at write time.

## Latest updates
- Nov 6, 2026: NVD receives CVE-2026-85295, CVE-2026-54349, CVE-2026-85712, CVE-2026-85708, CVE-2026-85726, CVE-2026-85736, CVE-2026-86005, and CVE-2026-54589 from security-advisories@github.com for the earlier Chartbrew patches.
- Sep 6, 2026: GitHub Security Advisories published for the 5.2.3 wave including GHSA-qvv4-r3q6-8797 (default CB_SECRET ATO), GHSA-6gv3-8wxh-6vfq (cross-tenant takeover), GHSA-3chp-cr6f-hp63 (forgeable share tokens), GHSA-mr45-2r9x-cgwf (Mongo date NoSQLi), GHSA-p5h6-f969-jpfv (root file delete), and GHSA-w8g3-j8rf-qc5j (BullMQ exposure).
- Jul 19, 2026: Chartbrew v5.2.3 security release: rejects legacy CB_SECRET session tokens, migrates share tokens to CB_ENCRYPTION_KEY, hardens tenant boundaries, protects BullMQ admin UI, and further query/path guards.
- Jul 6, 2026: GitHub publishes GHSA-4wj7-9gq7-mrr2 (unauthenticated SQLi via dashboard filter substitution) and GHSA-6m7q-jmp7-3vw8 (NAT64 SSRF in outbound URL guard); fixed in Chartbrew 5.2.1.

## Advisories
- [GHSA-qvv4-r3q6-8797 / CVE-2026-85295: full account takeover via default CB_SECRET JWTs](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797) (GitHub)
- [GHSA-4wj7-9gq7-mrr2 / CVE-2026-54349: unauthenticated SQLi via dashboard filter substitution](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4wj7-9gq7-mrr2) (GitHub)
- [GHSA-6gv3-8wxh-6vfq / CVE-2026-85712: cross-tenant project takeover via body.team_id](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq) (GitHub)
- [GHSA-3chp-cr6f-hp63 / CVE-2026-85708: private chart disclosure via forgeable share tokens](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-3chp-cr6f-hp63) (GitHub)
- [GHSA-mr45-2r9x-cgwf / CVE-2026-85726: blind NoSQL injection via MongoDB date variable](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mr45-2r9x-cgwf) (GitHub)
- [GHSA-p5h6-f969-jpfv / CVE-2026-85736: arbitrary file deletion via SSL/SSH connection paths](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p5h6-f969-jpfv) (GitHub)
- [GHSA-w8g3-j8rf-qc5j / CVE-2026-86005: unauthenticated BullMQ admin dashboard exposure](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w8g3-j8rf-qc5j) (GitHub)
- [GHSA-6m7q-jmp7-3vw8 / CVE-2026-54589: NAT64 SSRF bypass in outbound URL guard](https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6m7q-jmp7-3vw8) (GitHub)
- [Chartbrew v5.2.3 security release](https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3) (GitHub)
- [NVD: CVE-2026-85295](https://nvd.nist.gov/vuln/detail/CVE-2026-85295) (NVD)
- [NVD: CVE-2026-54349](https://nvd.nist.gov/vuln/detail/CVE-2026-54349) (NVD)
- [NVD: CVE-2026-85712](https://nvd.nist.gov/vuln/detail/CVE-2026-85712) (NVD)

---
Machine-readable: https://pwn.watch/i/chartbrew-default-secret-sqli-ato-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.