---
id: "CVE-2026-86005"
page: "https://infrastack.ai/live/CVE-2026-86005"
kind: "vulnerability"
aliases: ["CVE-2026-86005"]
title: "Chartbrew: unauthenticated BullMQ admin dashboard exposes job data and queue controls"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bullmq", "chartbrew", "package", "redis", "self-hosted"]
not_affected_if: ["redis-disabled", "route-blocked-at-proxy", "version-5.2.3-or-later"]
published_at: "2026-11-06T21:17:12+00:00"
first_seen_at: "2026-11-06T21:45:08+00:00"
updated_at: "2026-11-06T21:46:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86005", "first_seen_at": "2026-11-06T21:45:08+00:00"}]
exploit_sources: []
---

# Chartbrew: unauthenticated BullMQ admin dashboard exposes job data and queue controls

Link for people: https://infrastack.ai/live/CVE-2026-86005 (this .md is for agents)

Chartbrew mounts its BullMQ queue administration dashboard at /apps/queues without an authentication check. A remote attacker who can reach that route can read job payloads and logs and, depending on the Bull Board version and queue state, retry or delete jobs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm your Chartbrew version with the package manifest or deployed image tag; versions below `5.2.3` are affected
- Check whether Redis and BullMQ are enabled in your Chartbrew configuration
- Request `/apps/queues` from outside your network and see whether the dashboard loads without login
- Check whether your reverse proxy blocks `/apps/queues`

## Fix

- Chartbrew: upgrade to `5.2.3` or later

## Timeline

- 2026-11-06T21:45:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86005

## Documents

- [advisory] Vendor advisory: github.com https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w8g3-j8rf-qc5j
- [fix] Patch: github.com https://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aa
- [fix] Release notes: github.com https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3

## From the sources

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_