Chartbrew: default CB_SECRET lets anyone forge JWTs for any user (GHSA-qvv4, CVSS 9.8) — rotate secrets and upgrade now
- Do now: inspect
CB_SECRET/CB_ENCRYPTION_KEY; if CB_SECRET is the template value or empty-but-set, treat the instance as fully compromised for session purposes — rotate both secrets, force re-login, and upgrade to the current Chartbrew release that rejects the old placeholder path. - Review Chartbrew's security advisories list for the sibling Critical/High items (BullMQ dashboard, SSRF, SQLi, share-token forgery) on the same deploy.
- Internet-exposed Chartbrew with default env is the urgent case; air-gapped lab boxes still need the secret rotation before they are published.
Sources: GitHub Advisory GHSA-qvv4-r3q6-8797: Full account takeover via JWTs under default CB_SECRET · Chartbrew security advisories index