Authentication Bypass in Chartbrew's BullMQ Dashboard Exposes Sensitive Data

CVE-2026-86005

What is CVE-2026-86005?

Chartbrew, an open-source web application for creating charts from databases and APIs, suffers from an authentication bypass vulnerability in its BullMQ administration dashboard prior to version 5.2.3. The /apps/queues endpoint can be accessed without proper authentication, allowing remote unauthenticated attackers to inspect sensitive job payloads, logs, and potentially alter queue processing. This vulnerability arises when Redis and BullMQ are enabled and the dashboard route is improperly configured. Attackers could manipulate jobs depending on the current queue state and installed Bull Board version, posing risks to confidentiality, integrity, and availability of the system.

References