SECURITYHIGHCVE-2026-85708

CVE-2026-85708: Chartbrew Share and Embed Tokens Signed with Default Secret (CVSS 7.5)

Chartbrew before 5.2.3 signs chart share and embed tokens with CB_SECRET, including shipped defaults, so tokens can be forged.

Dylan H.

Security Team

November 7, 2026
2 min read
CVE-2026-85708: Chartbrew Share and Embed Tokens Signed with Default Secret (CVSS 7.5)

Affected Products

  • Chartbrew before 5.2.3

Overview

CVE-2026-85708 is a high-severity (CVSS 7.5) flaw in Chartbrew. Before version 5.2.3, chart share and embed tokens were signed with CB_SECRET, including known or shipped-default values found in stock source and repository Docker Compose installs. It was published on November 6, 2026.

FieldDetails
CVE IDCVE-2026-85708
CVSS Score7.5 (High)
Affected SoftwareChartbrew before 5.2.3
Fixed Version5.2.3

Vulnerability Details

Share and embed tokens control read access to individual charts. Because they are signed with the same CB_SECRET as other tokens, anyone who knows the default value can forge a valid token for a chart they were never given access to. This is the same root cause as CVE-2026-85295, applied to the chart-sharing feature rather than user sessions.

Impact

  • Unauthorized read access to charts and the data behind them
  • Bypass of sharing restrictions on dashboards intended to be private

Remediation

  1. Upgrade to Chartbrew 5.2.3 or later.
  2. Replace any default or weak CB_SECRET with a strong, unique random value.
  3. Re-issue share and embed links after rotating the secret, since old ones will stop working.
  4. Also address CVE-2026-54349, the SQL injection fixed in 5.2.1.

References