CVE-2026-85295

Summary

Chartbrew versions prior to 5.2.3 are vulnerable to authentication bypass via forged JWT session tokens signed with weak or default CB_SECRET values, allowing attackers to impersonate any user—including admin—without credentials or MFA.

Exploitability

Exploitation is trivial for attackers who can obtain or guess a known/weak/default CB_SECRET (e.g., from stock Docker Compose deployments), requiring only JWT forgery and submission of the forged token.

Blast radius

Successful exploitation grants full API and socket-layer access as the impersonated user, enabling data exfiltration, configuration tampering, and full system compromise if the target has elevated privileges.

Detection

Monitor for repeated JWT verification failures with HS256 algorithm and mismatched issuer/subject claims in API and socket logs, especially when tokens decode to unexpected user IDs; also watch for anomalous bulk API requests from a single session that lacks prior authentication history.

Prioritized remediation

Upgrade to Chartbrew version 5.2.3 or later; for deployments where upgrading is not immediately possible, rotate CB_SECRET to a cryptographically strong random value and ensure it is never reused or exposed in configuration files or logs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.