CVE-2026-85295: Chartbrew Accepts Session Tokens Signed with Default CB_SECRET (CVSS 9.8)

Overview

CVE-2026-85295 is a critical (CVSS 9.8) improper authentication flaw in Chartbrew. Before version 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. It was published November 6, 2026.

Vulnerability Details

Chartbrew signs session tokens with the CB_SECRET environment variable. Stock source installs and the repository's Docker Compose installs shipped with a known default value. An attacker who knows that value, or who can guess a weak one, can mint a valid session token for any chosen user. A forged session impersonates that user across the whole API and socket layer with their privileges.

A bare container with CB_SECRET undefined is not affected by this fallback path, according to the advisory summary.

Impact

• Impersonation of any Chartbrew user, including administrators
• Access to connected data sources and dashboards through the impersonated account
• No credentials required if the deployment uses a default or weak secret

Exploitation Status

No public exploit code has been confirmed, and the CVE is not in CISA's KEV catalog at the time of writing. Forging a JWT with a known key is trivial, so treat default-secret deployments as exposed.

Remediation

1. Upgrade to Chartbrew 5.2.3 or later.
2. Set CB_SECRET to a strong, unique random value on existing deployments. Upgrading alone does not change a secret you already deployed with.
3. Rotating the secret invalidates existing sessions; expect users to sign in again.
4. Review access logs for unexpected sessions or API activity from unfamiliar addresses.

References

• NVD Entry: CVE-2026-85295
• VulDB: CVE-2026-85295
• The Hacker Wire analysis