# CVE-2026-86005: Chartbrew BullMQ dashboard authentication bypass

Source: https://junglewise.ai/threats/cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-86005 · Severity: info · Published 2026-11-06

Chartbrew is an open-source data visualization tool that connects to databases and APIs to create charts. Prior to version 5.2.3, its administrative BullMQ job queue dashboard was accessible without authentication, allowing an unauthenticated attacker to view sensitive job data and potentially manipulate queued tasks if certain conditions are met. This could lead to exposure of confidential information within job payloads or unauthorized modification of data processing tasks.

Technologies: [Chartbrew](https://junglewise.ai/threats/technologies/chartbrew-chartbrew). Vendors: [Chartbrew](https://junglewise.ai/threats/vendors/chartbrew).

## Quick answers

**Is CVE-2026-86005 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86005 being exploited in the wild.

**How severe is CVE-2026-86005?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** Chartbrew before 5.2.3.

**Is there a fix for CVE-2026-86005?** Yes: fixed in 5.2.3. Until then: Set the CB_BULLMQ_USERNAME and CB_BULLMQ_PASSWORD environment variables to configure HTTP Basic Authentication for the /apps/queues dashboard, or use a reverse proxy to independently restrict access to that route. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86005 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86005?** Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.3

Set the CB_BULLMQ_USERNAME and CB_BULLMQ_PASSWORD environment variables to configure HTTP Basic Authentication for the /apps/queues dashboard, or use a reverse proxy to independently restrict access to that route.

## Technical details

An unauthenticated user can access the BullMQ administration dashboard at /apps/queues when Redis and BullMQ are enabled and the route is not blocked by a reverse proxy. The dashboard relied on network reachability as authorization. An attacker can inspect job payloads and logs; depending on the Bull Board version and queue state, they may also retry, delete, or otherwise manipulate queued jobs, affecting confidentiality, integrity, or availability. The vulnerability is fixed in version 5.2.3 by adding HTTP Basic Authentication.

## Affected products

- Chartbrew Chartbrew before 5.2.3

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aa](https://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aa)
- [https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3](https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3)

## Related threats

- [Chartbrew AI SQL blocklist bypass in PostgreSQL query validation](https://junglewise.ai/threats/cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew API connection private host bypass](https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts)
- [Chartbrew dashboard password brute force via plaintext storage](https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew arbitrary file deletion via connection cleanup](https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew MongoDB query injection in date-typed variables](https://junglewise.ai/threats/cve-2026-85726-chartbrew-is-an-open-source-web-application-that-can-connect)