{"id":"CVE-2026-86005","kind":"vulnerability","aliases":["CVE-2026-86005"],"related":[],"title":"Chartbrew: unauthenticated BullMQ admin dashboard exposes job data and queue controls","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.","summary":"Chartbrew mounts its BullMQ queue administration dashboard at /apps/queues without an authentication check. A remote attacker who can reach that route can read job payloads and logs and, depending on the Bull Board version and queue state, retry or delete jobs.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bullmq","chartbrew","package","redis","self-hosted"],"not_affected_if":["redis-disabled","route-blocked-at-proxy","version-5.2.3-or-later"],"how_to_check":"- Confirm your Chartbrew version with the package manifest or deployed image tag; versions below `5.2.3` are affected\n- Check whether Redis and BullMQ are enabled in your Chartbrew configuration\n- Request `/apps/queues` from outside your network and see whether the dashboard loads without login\n- Check whether your reverse proxy blocks `/apps/queues`","fix":"- Chartbrew: upgrade to `5.2.3` or later","status":"open","published_at":"2026-11-06T21:17:12+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:31+00:00","updated_at":"2026-11-06T21:46:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:31Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: upgrade to `5.2.3` or later","reach":"internet","title":"Chartbrew: unauthenticated BullMQ admin dashboard exposes job data and queue controls","impact":"high","summary":"Chartbrew mounts its BullMQ queue administration dashboard at /apps/queues without an authentication check. A remote attacker who can reach that route can read job payloads and logs and, depending on the Bull Board version and queue state, retry or delete jobs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chartbrew","self-hosted","bullmq","redis"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads job payloads and logs, and may alter queue processing","analyst_note":"","how_to_check":"- Confirm your Chartbrew version with the package manifest or deployed image tag; versions below `5.2.3` are affected\n- Check whether Redis and BullMQ are enabled in your Chartbrew configuration\n- Request `/apps/queues` from outside your network and see whether the dashboard loads without login\n- Check whether your reverse proxy blocks `/apps/queues`","plain_action":"","needs_analyst":false,"not_affected_if":["redis-disabled","route-blocked-at-proxy","version-5.2.3-or-later"],"who_is_affected":"Instances of Chartbrew before 5.2.3 where Redis and BullMQ are enabled and the /apps/queues route is reachable, because a reverse proxy does not block it. The dashboard relied on network reachability as its only access control. Deployments with Redis/BullMQ disabled, or with the route blocked at the proxy or behind another authentication layer, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000772,"input_tokens":4510,"output_tokens":642,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86005':14A,17A '/apps/queues':33B,112C,118C '5.2.3':91C,227C 'action':167C 'admin':4A 'administr':30B,93C,109C 'affect':216C 'alter':213C 'api':81C 'applic':73C 'attack':40B,116C 'authent':36B,100C 'author':145C 'avail':166C,220C 'block':136C 'board':57B,173C 'board/bullmq':108C 'bull':56B,107C,172C 'bullmq':3A,18B,28B,94C,126C,156C 'chart':88C 'chartbrew':1A,19B,25B,66C,121C 'check':37B,101C 'confidenti':179C,217C 'connect':76C 'content':186C 'control':11A 'creat':87C 'cve':12A,15A 'dashboard':5A,31B,95C,110C,140C 'data':8A,85C 'databas':79C 'delet':64B,209C 'depend':53B,168C,180C 'direct':77C,153C 'enabl':128C,159C,199C 'expos':6A,147C,192C 'fix':224C 'host':24B 'independ':135C 'inspect':191C 'instal':171C,202C 'instanc':122C 'integr':218C 'interfac':152C 'issu':222C 'job':7A,48B,65B,182C,193C,210C 'log':51B,185C,196C 'manag':151C 'mount':26B,97C 'must':157C,163C 'network':142C 'open':70C 'open-sourc':69C 'otherwis':212C 'packag':20B 'payload':49B,183C,194C 'prior':89C 'process':215C 'proxi':132C 'queue':10A,29B,60B,150C,176C,205C,214C 'queue-manag':149C 'reach':43B,117C 'reachabl':143C,165C 'read':47B 'redi':21B,124C,154C 'remot':39B,114C 'retri':62B,207C 'revers':131C 'rout':45B,138C,162C 'self':23B 'self-host':22B 'sourc':71C 'state':61B,177C,206C 'surfac':104C 'trust':141C 'unauthent':2A,115C,188C 'use':83C 'user':189C 'version':58B,174C,203C,226C 'vulner':103C 'web':72C 'without':34B,98C","nicknames":[],"mitigations":[],"who_affected":"Instances of Chartbrew before 5.2.3 where Redis and BullMQ are enabled and the /apps/queues route is reachable, because a reverse proxy does not block it. The dashboard relied on network reachability as its only access control. Deployments with Redis/BullMQ disabled, or with the route blocked at the proxy or behind another authentication layer, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bullmq","chartbrew","critical","package","redis","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-86005':14A,17A 'admin':4A 'bullmq':3A 'chartbrew':1A 'control':11A 'cve':12A,15A 'dashboard':5A 'data':8A 'expos':6A 'job':7A 'queue':10A 'unauthent':2A","search_b":"'/apps/queues':33B 'administr':30B 'attack':40B 'authent':36B 'board':57B 'bull':56B 'bullmq':18B,28B 'chartbrew':19B,25B 'check':37B 'dashboard':31B 'delet':64B 'depend':53B 'host':24B 'job':48B,65B 'log':51B 'mount':26B 'packag':20B 'payload':49B 'queue':29B,60B 'reach':43B 'read':47B 'redi':21B 'remot':39B 'retri':62B 'rout':45B 'self':23B 'self-host':22B 'state':61B 'version':58B 'without':34B","search_c":"'/apps/queues':112C,118C '5.2.3':91C,227C 'action':167C 'administr':93C,109C 'affect':216C 'alter':213C 'api':81C 'applic':73C 'attack':116C 'authent':100C 'author':145C 'avail':166C,220C 'block':136C 'board':173C 'board/bullmq':108C 'bull':107C,172C 'bullmq':94C,126C,156C 'chart':88C 'chartbrew':66C,121C 'check':101C 'confidenti':179C,217C 'connect':76C 'content':186C 'creat':87C 'dashboard':95C,110C,140C 'data':85C 'databas':79C 'delet':209C 'depend':168C,180C 'direct':77C,153C 'enabl':128C,159C,199C 'expos':147C,192C 'fix':224C 'independ':135C 'inspect':191C 'instal':171C,202C 'instanc':122C 'integr':218C 'interfac':152C 'issu':222C 'job':182C,193C,210C 'log':185C,196C 'manag':151C 'mount':97C 'must':157C,163C 'network':142C 'open':70C 'open-sourc':69C 'otherwis':212C 'payload':183C,194C 'prior':89C 'process':215C 'proxi':132C 'queue':150C,176C,205C,214C 'queue-manag':149C 'reach':117C 'reachabl':143C,165C 'redi':124C,154C 'remot':114C 'retri':207C 'revers':131C 'rout':138C,162C 'sourc':71C 'state':177C,206C 'surfac':104C 'trust':141C 'unauthent':115C,188C 'use':83C 'user':189C 'version':174C,203C,226C 'vulner':103C 'web':72C 'without':98C","first_public_at":"2026-09-06T05:06:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86005","severity":null,"published_at":"2026-11-06T21:17:12+00:00","modified_at":"2026-11-06T21:17:12+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90362,"url":"https://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aa","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90344,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90364,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w8g3-j8rf-qc5j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-06T05:06:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}