Is CVE-2026-68933 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68933 being exploited in the wild.

How severe is CVE-2026-68933?

High severity, with a CVSS score of 7.5, published 6 November 2026.

Is there a fix for CVE-2026-68933?

Yes: fixed in 5.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68933 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-68933?

Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68933: Chartbrew dashboard password brute force via plaintext storage

CVE-2026-68933 · Severity: high · CVSS 7.5 · Published 2026-11-06

Chartbrew is an open-source web application that creates charts from data stored in databases and APIs. Prior to version 5.2.3, password-protected public dashboards stored passwords in plaintext and accepted them via URL query parameters without rate limiting, allowing attackers to brute force access. An attacker who cracks the password gains full access to the dashboard and all its underlying chart data.

Technologies: Chartbrew. Vendors: Chartbrew.

Quick answers

Is CVE-2026-68933 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68933 being exploited in the wild.
How severe is CVE-2026-68933?: High severity, with a CVSS score of 7.5, published 6 November 2026.
Which products and versions are affected?: Chartbrew before 5.2.3.
Is there a fix for CVE-2026-68933?: Yes: fixed in 5.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68933 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-68933?: Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.2.3

Technical details

The vulnerability involves plaintext storage of dashboard passwords, acceptance of passwords through URL query parameters, and absence of rate limiting on password validation attempts. An unauthenticated attacker can target a public password-protected dashboard and submit unlimited candidate passwords to guess the correct one. Failed attempts still leak dashboard metadata (chart count and configuration), and recovered passwords grant access to protected chart data. The fix in 5.2.3 encrypts dashboard passwords and implements rate limiting on validation routes.

Affected products

Chartbrew Chartbrew before 5.2.3

Timeline

2026-11-06: disclosed
2026-07-06: patched: Fix committed; v5.2.3 released 19 Jul 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.