---
id: CVE-2026-86005
title: 'Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew'
summary: >-
  Chartbrew is an open-source web application that can connect directly to
  databases and APIs and use the data to create charts. Prior to 5.2.3, the
  administrative BullMQ dashboard was mounted without an authentication check.
  The vulnerabl…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: chartbrew
product: chartbrew
affected:
  - chartbrew < 5.2.3
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T21:10:41.526Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86005'
references:
  - url: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w8g3-j8rf-qc5j
    label: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w8g3-j8rf-qc5j
  - url: >-
      https://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aa
    label: >-
      https://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aa
  - url: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3'
    label: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3'
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.328Z'
epss: 0.00468
epssPercentile: 0.40716
---

## Overview

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.

## Affected

- `chartbrew < 5.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.