CVE-2026-85708 · Package
NO FIX YET · SEE WHAT TO DO
Chartbrew signed chart share and embed tokens with CB_SECRET, which in stock source and repository Docker Compose installs is a known or shipped default value. An attacker who knows that secret can forge tokens and read private chart data, including chartData, by enumerating integer chart ids.
first public Sep 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Chartbrew before version 5.2.3 using the stock source or repository Docker Compose setup with a default or known CB_SECRET, and that have shared at least one private chart. Deployments with a unique, unpredictable CB_SECRET are not exposed through this path, and a bare container with CB_SECRET undefined is outside it.
Not affected if managed-hosting, unique-cb-secret, version-5.2.3-or-later
Who cares chartbrew, docker-compose, self-hosted
CB_SECRET value in your Chartbrew environment or Docker Compose file and confirm it is not a shipped default from the stock source or repository.5.2.3 are affected.5.2.3 or later.Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CB_SECRET, including known or shipped-default values in stock source and repository Docker Compose installs. The vulnerable surface is chart share-token verification and filter-access routes for private charts. An attacker who knows the deployment's CB_SECRET targets a private chart that has been shared at least once so a share-policy row exists, then forges a Chart-subject token for that chart id. The known signing key permits valid Chart tokens, and the filter-access path accepts sequential integer ids without requiring a legitimate share link; token expiry and revocation are ineffective once the secret is known. The condition requires a known or default secret and an existing share-policy row. A bare container where CB_SECRET is undefined is outside this path, and a unique secret excludes it only while the value remains unknown and unpredictable. An unauthenticated attacker can enumerate integer ids and read arbitrary private chart data, including chartData, without possessing a legitimate share link. This issue is fixed in version 5.2.3.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.