# CVE-2026-85708: Chartbrew chart share token forgery with default secret

Source: https://junglewise.ai/threats/cve-2026-85708-chartbrew-is-an-open-source-web-application-that-can-connect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-85708 · Severity: high · CVSS 7.5 · Published 2026-11-06

Chartbrew is an open-source analytics application that connects to databases and APIs to generate charts and dashboards. In versions before 5.2.3, the application used a default or known signing key to generate share tokens for private charts, allowing an attacker to forge valid tokens and access arbitrary private chart data without authorization. An unauthenticated attacker can enumerate chart IDs and read sensitive data from any chart that has been shared at least once.

Technologies: [Chartbrew](https://junglewise.ai/threats/technologies/chartbrew-chartbrew). Vendors: [Chartbrew](https://junglewise.ai/threats/vendors/chartbrew).

## Quick answers

**Is CVE-2026-85708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85708 being exploited in the wild.

**How severe is CVE-2026-85708?** High severity, with a CVSS score of 7.5, published 6 November 2026.

**Which products and versions are affected?** Chartbrew before 5.2.3.

**Is there a fix for CVE-2026-85708?** Yes: fixed in 5.2.3. Until then: Ensure CB_SECRET is set to a unique, unpredictable value and keep it private. Disable CB_ALLOW_LEGACY_SHARE_TOKENS on new installations. Review and regenerate any share tokens created with the default CB_SECRET. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85708 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85708?** Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.3

Ensure CB_SECRET is set to a unique, unpredictable value and keep it private. Disable CB_ALLOW_LEGACY_SHARE_TOKENS on new installations. Review and regenerate any share tokens created with the default CB_SECRET.

## Technical details

Chart share and embed tokens were signed with CB_SECRET, which may be a known default or shipped value in Docker Compose installations. An attacker who knows the deployment's CB_SECRET can forge valid Chart-subject tokens for any chart ID, bypassing share-token verification on the filter-access routes. Token expiry and revocation are ineffective once the secret is known. The vulnerability requires an existing share-policy row for the target chart and knowledge of the CB_SECRET value; a unique secret or undefined CB_SECRET mitigates the issue.

## Affected products

- Chartbrew Chartbrew before 5.2.3

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/chartbrew/chartbrew/commit/07fff78db39e1c073a0301ac382c565268824e09](https://github.com/chartbrew/chartbrew/commit/07fff78db39e1c073a0301ac382c565268824e09)
- [https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3](https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3)

## Related threats

- [Chartbrew AI SQL blocklist bypass in PostgreSQL query validation](https://junglewise.ai/threats/cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew API connection private host bypass](https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts)
- [Chartbrew dashboard password brute force via plaintext storage](https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew BullMQ dashboard authentication bypass](https://junglewise.ai/threats/cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew arbitrary file deletion via connection cleanup](https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect)