{"metadata": {"vulnerability": "CVE-2026-86005", "count": 9, "kinds": {"milestone": 3, "sighting": 3, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-09-04T19:17:36.246Z", "date_only": false, "value": "2026-09-04T19:17:36.246Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-86005", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-06T21:10:41.526Z", "date_only": false, "value": "2026-11-06T21:10:41.526Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-06T21:10:41.526Z", "date_only": false, "value": "2026-11-06T21:10:41.526Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-86005", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:10:41.526Z", "date_only": false, "value": "2026-11-06T21:10:41.526Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-86005", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T21:17:12.117Z", "date_only": false, "value": "2026-11-06T21:17:12.117", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86005", "record": "FKIE_CVE-2026-86005", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T21:17:12.253Z", "date_only": false, "value": "2026-11-06T21:17:12.253", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86005", "record": "FKIE_CVE-2026-86005", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-06T21:21:40.254Z", "date_only": false, "value": "2026-11-06T21:21:40.254724Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117571590540839144", "record": "CVE-2026-86005", "field": "creation_timestamp", "uuid": "13bbbf25-a32f-43d3-b8f7-d3d766e3e031", "content": "CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.\nhttps://www.cve.org/CVERecord?id=CVE-2026-86005https://github.com/chartbrew/chartbrew/security/advisories/GHSA-w8g3-j8rf-qc5jhttps://github.com/chartbrew/chartbrew/commit/91873ce25d2b76d7bb6de7c61f372d03d56cc4aahttps://github.com/chartbrew/chartbrew/releases/tag/v5.2.3#chartbrew#CVE_2026_86005#bot", "url": "https://infosec.exchange/users/cve/statuses/117571590540839144"}, {"timestamp": "2026-11-06T22:08:25.302Z", "date_only": false, "value": "2026-11-06T22:08:25.302105Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzofgxr5lm2j", "record": "CVE-2026-86005", "field": "creation_timestamp", "uuid": "061cc0e8-b689-4ade-b040-45d913cccb79", "content": "\ud83d\udea8 CVE-2026-86005 \u2014 CVSS 9.3 CRITICAL\n\nChartbrew is an open-source web application that can connect directly to databases and APIs and use the dat...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-86005\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzofgxr5lm2j"}, {"timestamp": "2026-11-07T01:50:03.107Z", "date_only": false, "value": "2026-11-07T01:50:03.107209Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzortba5w22v", "record": "CVE-2026-86005", "field": "creation_timestamp", "uuid": "284eb2d1-93cd-45b7-8c64-79108412541a", "content": "CVE-2026-86005 - chartbrew\nThe web\u2011based Chartbrew app (versions before 5.2.3) exposed its internal BullMQ queue\u2011management page without requiring a login. Anyone who can reach the /apps/queues URL can see job\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#chartbrew #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzortba5w22v"}], "metrics": {"as_of": "2026-11-08T05:00:01.979Z", "anchors": {"origin": {"timestamp": "2026-11-06T21:10:41.526Z", "date_only": false, "value": "2026-11-06T21:10:41.526Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-06T21:10:41.526Z", "date_only": false, "value": "2026-11-06T21:10:41.526Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 114560.45353, "hours": 31.82234820277778, "days": 1.3259311751157408, "min_seconds": 114560.45353, "max_seconds": 114560.45353, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-06T21:10:41.526Z", "date_only": false, "value": "2026-11-06T21:10:41.526Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86005", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T05:00:01.979Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}