{"metadata": {"vulnerability": "CVE-2026-85295", "count": 10, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-09-03T16:37:49.262Z", "date_only": false, "value": "2026-09-03T16:37:49.262Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-85295", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T21:05:31.286Z", "date_only": false, "value": "2026-11-06T21:05:31.286Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85295", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-06T21:05:31.286Z", "date_only": false, "value": "2026-11-06T21:05:31.286Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-85295", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:05:31.286Z", "date_only": false, "value": "2026-11-06T21:05:31.286Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-85295", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:17:10.890Z", "date_only": false, "value": "2026-11-06T21:17:10.890", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85295", "record": "FKIE_CVE-2026-85295", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T21:17:11.140Z", "date_only": false, "value": "2026-11-06T21:17:11.140", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85295", "record": "FKIE_CVE-2026-85295", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T21:18:18.526Z", "date_only": false, "value": "2026-11-06T21:18:18.526147Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117571577317429811", "record": "CVE-2026-85295", "field": "creation_timestamp", "uuid": "9346f274-094e-4872-9609-dd5b4f5b679e", "content": "CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CB_SECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user's password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CB_SECRET; a bare container where CB_SECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user's Chartbrew privileges. This issue is fixed in version 5.2.3.\nhttps://www.cve.org/CVERecord?id=CVE-2026-85295https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797https://github.com/chartbrew/chartbrew/commit/da8c71f156aaa13fbc7ead15a4726740fef2b3c5https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3#chartbrew#CVE_2026_85295#bot", "url": "https://infosec.exchange/users/cve/statuses/117571577317429811"}, {"timestamp": "2026-11-06T21:48:11.495Z", "date_only": false, "value": "2026-11-06T21:48:11.495129Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzoecrn7h726", "record": "CVE-2026-85295", "field": "creation_timestamp", "uuid": "cb8000ca-83ab-437a-aa46-25b8e721b2e2", "content": "\ud83d\udd34 CVE-2026-85295 - Critical (9.8)\n\nChartbrew is an open-source web application that can connect directly to databases and APIs and u...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-85295/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mzoecrn7h726"}, {"timestamp": "2026-11-06T22:08:17.218Z", "date_only": false, "value": "2026-11-06T22:08:17.218441Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzofgpwn532w", "record": "CVE-2026-85295", "field": "creation_timestamp", "uuid": "6c7172af-4d6e-4681-b374-cfb3fb6d0a52", "content": "\ud83d\udea8 CVE-2026-85295 \u2014 CVSS 9.8 CRITICAL\n\nChartbrew is an open-source web application that can connect directly to databases and APIs and use the dat...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85295\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzofgpwn532w"}, {"timestamp": "2026-11-07T01:40:05.326Z", "date_only": false, "value": "2026-11-07T01:40:05.326228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzorbhe6sn27", "record": "CVE-2026-85295", "field": "creation_timestamp", "uuid": "fc1feb3a-0731-4b66-bddd-32f7ee46d185", "content": "CVE-2026-85295 - chartbrew\nChartbrew versions before 5.2.3 accept session tokens signed with a default or easy-to-guess secret key. If the secret is left unchanged, an attacker can create a fake token that lets\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#chartbrew #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzorbhe6sn27"}], "metrics": {"as_of": "2026-11-08T02:39:02.450Z", "anchors": {"origin": {"timestamp": "2026-11-06T21:05:31.286Z", "date_only": false, "value": "2026-11-06T21:05:31.286Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85295", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-06T21:05:31.286Z", "date_only": false, "value": "2026-11-06T21:05:31.286Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85295", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 106411.164175, "hours": 29.558656715277777, "days": 1.2316106964699074, "min_seconds": 106411.164175, "max_seconds": 106411.164175, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T21:05:31.286Z", "date_only": false, "value": "2026-11-06T21:05:31.286Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85295", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T02:39:02.450Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}