CVE-2026-86005 in Chartbrew
Summary
by MITRE • 11/06/2026
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in Chartbrew prior to version 5.2.3 represents a critical authentication bypass within the administrative interface of the BullMQ dashboard. Chartbrew serves as an open-source web application designed to connect directly to databases and APIs, utilizing this data to generate visual charts and dashboards for users. A core component of its backend infrastructure is BullMQ, a robust queue management system built on top of Redis, which handles asynchronous job processing. The administrative interface provided by Bull Board allows administrators to monitor and manage these queues. However, in versions preceding 5.2.3, this specific endpoint located at /apps/queues was mounted without implementing any form of authentication check or access control validation. This architectural flaw means that the security posture relied entirely on external factors rather than intrinsic application-level protections.
The operational impact of this vulnerability is significant because it allows remote unauthenticated attackers to interact with sensitive queue management features. For an attacker to exploit this issue, specific conditions must be met: Redis and BullMQ must be enabled within the Chartbrew instance, and the route /apps/queues must be reachable by external networks. This reachability often occurs when a reverse proxy or web server does not independently block access to administrative routes that are intended for internal use only. Once an attacker gains network-level access to this endpoint, they can inspect exposed job payloads and logs without any credentials. The sensitivity of the data accessed depends on the specific content stored in the queues, which may include sensitive user information, API keys, or proprietary business logic embedded within job parameters.
Beyond mere observation, the vulnerability permits active manipulation of queue processing depending on the installed version of Bull Board and the current state of the queues. An unauthenticated attacker can potentially retry failed jobs, delete pending or completed jobs, or otherwise alter the flow of data through the system. These actions directly compromise the integrity of the application by allowing unauthorized modifications to job states and payloads. Furthermore, if an attacker deletes critical jobs required for scheduled tasks or user-triggered processes, it leads to a denial of service affecting availability. The exposure of logs also poses a severe confidentiality risk, as these logs often contain detailed execution traces that may reveal internal system architecture, database connection strings, or other sensitive configuration details.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. The attack vector is consistent with ATT&CK technique T1505.003 Server Software Component: Web Queue, where an adversary interacts directly with a web queue to manipulate system behavior or exfiltrate data. The lack of authentication on an administrative interface effectively renders all security controls dependent on network segmentation and reverse proxy configurations, which are often misconfigured in production environments.
To mitigate this vulnerability, organizations running Chartbrew must immediately upgrade to version 5.2.3 or later, where the authentication check has been properly implemented for the BullMQ dashboard endpoint. In addition to upgrading, administrators should enforce strict access controls at the network level by configuring reverse proxies such as Nginx or Apache to explicitly deny external access to administrative routes like /apps/queues unless they are accessed from trusted internal IP ranges. Implementing Web Application Firewall rules that block unauthorized requests to known administration endpoints provides an additional layer of defense in depth, ensuring that even if application-level controls fail, the attack surface remains restricted to authorized personnel only.