{"id":"CVE-2026-85708","kind":"vulnerability","aliases":["CVE-2026-85708"],"related":[],"title":"Chartbrew: forged share tokens expose private chart data when secret is default","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CB_SECRET, including known or shipped-default values in stock source and repository Docker Compose installs. The vulnerable surface is chart share-token verification and filter-access routes for private charts. An attacker who knows the deployment's CB_SECRET targets a private chart that has been shared at least once so a share-policy row exists, then forges a Chart-subject token for that chart id. The known signing key permits valid Chart tokens, and the filter-access path accepts sequential integer ids without requiring a legitimate share link; token expiry and revocation are ineffective once the secret is known. The condition requires a known or default secret and an existing share-policy row. A bare container where CB_SECRET is undefined is outside this path, and a unique secret excludes it only while the value remains unknown and unpredictable. An unauthenticated attacker can enumerate integer ids and read arbitrary private chart data, including chartData, without possessing a legitimate share link. This issue is fixed in version 5.2.3.","summary":"Chartbrew signed chart share and embed tokens with CB_SECRET, which in stock source and repository Docker Compose installs is a known or shipped default value. An attacker who knows that secret can forge tokens and read private chart data, including chartData, by enumerating integer chart ids.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chartbrew","docker-compose","package","self-hosted"],"not_affected_if":["managed-hosting","unique-cb-secret","version-5.2.3-or-later"],"how_to_check":"- Check the `CB_SECRET` value in your Chartbrew environment or Docker Compose file and confirm it is not a shipped default from the stock source or repository.\n- Check the installed Chartbrew version; versions before `5.2.3` are affected.","fix":"- Chartbrew: move to `5.2.3` or later.","status":"open","published_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:39+00:00","updated_at":"2026-11-06T21:46:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:39Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: move to `5.2.3` or later.","reach":"internet","title":"Chartbrew: forged share tokens expose private chart data when secret is default","impact":"high","summary":"Chartbrew signed chart share and embed tokens with CB_SECRET, which in stock source and repository Docker Compose installs is a known or shipped default value. An attacker who knows that secret can forge tokens and read private chart data, including chartData, by enumerating integer chart ids.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chartbrew","self-hosted","docker-compose"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker reads arbitrary private chart data","analyst_note":"","how_to_check":"- Check the `CB_SECRET` value in your Chartbrew environment or Docker Compose file and confirm it is not a shipped default from the stock source or repository.\n- Check the installed Chartbrew version; versions before `5.2.3` are affected.","plain_action":"","needs_analyst":false,"not_affected_if":["unique-cb-secret","managed-hosting","version-5.2.3-or-later"],"who_is_affected":"Teams that self-host Chartbrew before version 5.2.3 using the stock source or repository Docker Compose setup with a default or known CB_SECRET, and that have shared at least one private chart. Deployments with a unique, unpredictable CB_SECRET are not exposed through this path, and a bare container with CB_SECRET undefined is outside it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4540,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-85708':15A,18A '5.2.3':99C,283C 'accept':194C 'access':137C,192C 'api':89C 'applic':81C 'arbitrari':265C 'attack':54B,143C,258C 'bare':231C 'cb':35B,108C,149C,234C 'chart':7A,29B,65B,72B,96C,100C,129C,141C,154C,173C,178C,186C,267C 'chart-subject':172C 'chartbrew':1A,19B,27B,74C 'chartdata':68B,270C 'compos':22B,44B,123C 'condit':216C 'connect':84C 'contain':232C 'creat':95C 'cve':13A,16A 'data':8A,66B,93C,268C 'databas':87C 'default':12A,51B,115C,221C 'deploy':147C 'direct':85C 'docker':21B,43B,122C 'docker-compos':20B 'emb':32B,103C 'enumer':70B,260C 'exclud':246C 'exist':168C,225C 'expiri':205C 'expos':5A 'filter':136C,191C 'filter-access':135C,190C 'fix':280C 'forg':2A,60B,170C 'host':26B 'id':73B,179C,197C,262C 'includ':67B,110C,269C 'ineffect':209C 'instal':45B,124C 'integ':71B,196C,261C 'issu':278C 'key':183C 'know':56B,145C 'known':48B,111C,181C,214C,219C 'least':160C 'legitim':201C,274C 'link':203C,276C 'open':78C 'open-sourc':77C 'outsid':239C 'packag':23B 'path':193C,241C 'permit':184C 'polici':166C,228C 'possess':272C 'prior':97C 'privat':6A,64B,140C,153C,266C 'read':63B,264C 'remain':252C 'repositori':42B,121C 'requir':199C,217C 'revoc':207C 'rout':138C 'row':167C,229C 'secret':10A,36B,58B,109C,150C,212C,222C,235C,245C 'self':25B 'self-host':24B 'sequenti':195C 'share':3A,30B,101C,131C,158C,165C,202C,227C,275C 'share-polici':164C,226C 'share-token':130C 'ship':50B,114C 'shipped-default':113C 'sign':28B,106C,182C 'sourc':40B,79C,119C 'stock':39B,118C 'subject':174C 'surfac':127C 'target':151C 'token':4A,33B,61B,104C,132C,175C,187C,204C 'unauthent':257C 'undefin':237C 'uniqu':244C 'unknown':253C 'unpredict':255C 'use':91C 'valid':185C 'valu':52B,116C,251C 'verif':133C 'version':282C 'vulner':126C 'web':80C 'without':198C,271C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Chartbrew before version 5.2.3 using the stock source or repository Docker Compose setup with a default or known CB_SECRET, and that have shared at least one private chart. Deployments with a unique, unpredictable CB_SECRET are not exposed through this path, and a bare container with CB_SECRET undefined is outside it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chartbrew","dockercompose","high","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-85708':15A,18A 'chart':7A 'chartbrew':1A 'cve':13A,16A 'data':8A 'default':12A 'expos':5A 'forg':2A 'privat':6A 'secret':10A 'share':3A 'token':4A","search_b":"'attack':54B 'cb':35B 'chart':29B,65B,72B 'chartbrew':19B,27B 'chartdata':68B 'compos':22B,44B 'data':66B 'default':51B 'docker':21B,43B 'docker-compos':20B 'emb':32B 'enumer':70B 'forg':60B 'host':26B 'id':73B 'includ':67B 'instal':45B 'integ':71B 'know':56B 'known':48B 'packag':23B 'privat':64B 'read':63B 'repositori':42B 'secret':36B,58B 'self':25B 'self-host':24B 'share':30B 'ship':50B 'sign':28B 'sourc':40B 'stock':39B 'token':33B,61B 'valu':52B","search_c":"'5.2.3':99C,283C 'accept':194C 'access':137C,192C 'api':89C 'applic':81C 'arbitrari':265C 'attack':143C,258C 'bare':231C 'cb':108C,149C,234C 'chart':96C,100C,129C,141C,154C,173C,178C,186C,267C 'chart-subject':172C 'chartbrew':74C 'chartdata':270C 'compos':123C 'condit':216C 'connect':84C 'contain':232C 'creat':95C 'data':93C,268C 'databas':87C 'default':115C,221C 'deploy':147C 'direct':85C 'docker':122C 'emb':103C 'enumer':260C 'exclud':246C 'exist':168C,225C 'expiri':205C 'filter':136C,191C 'filter-access':135C,190C 'fix':280C 'forg':170C 'id':179C,197C,262C 'includ':110C,269C 'ineffect':209C 'instal':124C 'integ':196C,261C 'issu':278C 'key':183C 'know':145C 'known':111C,181C,214C,219C 'least':160C 'legitim':201C,274C 'link':203C,276C 'open':78C 'open-sourc':77C 'outsid':239C 'path':193C,241C 'permit':184C 'polici':166C,228C 'possess':272C 'prior':97C 'privat':140C,153C,266C 'read':264C 'remain':252C 'repositori':121C 'requir':199C,217C 'revoc':207C 'rout':138C 'row':167C,229C 'secret':109C,150C,212C,222C,235C,245C 'sequenti':195C 'share':101C,131C,158C,165C,202C,227C,275C 'share-polici':164C,226C 'share-token':130C 'ship':114C 'shipped-default':113C 'sign':106C,182C 'sourc':79C,119C 'stock':118C 'subject':174C 'surfac':127C 'target':151C 'token':104C,132C,175C,187C,204C 'unauthent':257C 'undefin':237C 'uniqu':244C 'unknown':253C 'unpredict':255C 'use':91C 'valid':185C 'valu':116C,251C 'verif':133C 'version':282C 'vulner':126C 'web':80C 'without':198C,271C","first_public_at":"2026-09-06T04:52:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85708","severity":null,"published_at":"2026-11-06T21:17:11+00:00","modified_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90346,"url":"https://github.com/chartbrew/chartbrew/commit/07fff78db39e1c073a0301ac382c565268824e09","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90344,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90348,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-3chp-cr6f-hp63","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-06T04:52:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}