Skip to content
Daily Threat Briefings
Community RSS
← All articles cvesecurityself-hosted

🚨 Weekly Self-Hosted Security Summary (November 5 – November 11, 2026)

Here’s a roundup of 8 critical/high security issues disclosed this week affecting popular open-source self-hosted projects, plus 3 earlier advisories for Langflow, Portainer and Mastodon we hadn’t covered yet (see Missed Earlier). Start with your edge: OpenSSH has a password…

hhf technology¡14 min read

Here’s a roundup of 10 critical/high security issues disclosed this week affecting popular open-source self-hosted projects, plus 1 earlier Pocket ID advisory we hadn’t covered yet (see Missed Earlier). Start with what’s being exploited: CISA added OpenSSH “SSHole” (Alpine and other musl-based systems), GPUStack and FreeSWITCH to its KEV list on November 9. Then patch your apps: React Server Components has a new unauthenticated RCE, Discourse fixed 12 High issues including an admin takeover, and Budibase 4.0.0 closes 30 advisories, several of them Critical and unauthenticated.

1. OpenSSH “SSHole”: Password Login Bypass on Alpine / musl Without PAM (Actively Exploited)

CVE-2026-123158 | Disclosed: November 5, 2026 (OpenSSH 10.6p2 and Alpine advisory; added to CISA KEV November 9)
Project : OpenSSH (portable sshd on musl libc: Alpine, plus some OpenWrt/Buildroot/Yocto-style builds)

Technical Details : Built without PAM, sshd checks a password by running it through crypt() and comparing the result with the stored field. For accounts whose field has no salt (like *, the normal value for key-only accounts), it borrows another account’s salt. musl’s crypt() returns * as its error value when the input is over 256 bytes, which matches the stored *, so a 257 – 1024 byte password logs in. You need one account with a $5$/$6$ hash on the box, and then every passwordless account can be reached. Exploitation attempts started November 5, the day a PoC came out. GreyNoise logged the first successful break-in on November 7. Attackers did recon, queried cloud metadata, tried to read hashes and root keys, and added their own authorized_keys. glibc distros (Debian, Ubuntu, RHEL) aren’t affected. Neither is openssh-server-pam with UsePAM yes, or any box with PasswordAuthentication no.

  • Severity : High (CVSS 8.1), on CISA KEV
  • Affected : sshd before 10.6p2 on musl Linux without PAM, with PasswordAuthentication yes (the default). Every Alpine release from 3.16 to 3.24 and edge
  • Fixed : OpenSSH 10.6p2. Alpine openssh 10.6_p2-r0 (edge), 10.3_p1-r2 (3.24), 10.2_p1-r1 (3.23), 10.0_p1-r11 (3.22), 9.9_p2-r1 (3.21), with backports down to 3.16. Run apk upgrade -U -a, then restart sshd. Upgrading the package doesn’t replace the running daemon.
  • Workaround : Set PasswordAuthentication no and restart sshd. Check Alpine-based containers and images that run their own sshd (e.g. sshd/SFTP sidecars). Look in /var/log/messages for Accepted password for on accounts that have no password, and check authorized_keys and doas use. If you can’t rule out a login, treat the host as compromised.

Reference : Alpine advisory / OpenSSH 10.6p2 release notes / NVD CVE-2026-123158 / CISA KEV alert (Nov 9) / BleepingComputer

2. GPUStack: Reverse Proxy on Localhost = Unauthenticated Admin, Plus Forged SAML Login (Actively Exploited)

CVE-2026-102895, CVE-2026-102894 | Disclosed: November 4, 2026 (NVD) / November 9 – 10, 2026 (GitHub Advisory Database); CVE-2026-102895 added to CISA KEV November 9
Project : GPUStack (GPU cluster manager for self-hosted AI model serving)

Technical Details :

  • CVE-2026-102895: With force_auth_localhost at its default of false, GPUStack treats any request from loopback as the built-in admin. Put it behind a reverse proxy on the same host (proxy_pass http://127.0.0.1:...) and every internet request looks like loopback. A forged X-GPUStack-Real-IP: 127.0.0.1 header works too. The result is full admin: users, models, workers, worker and cloud-provider secrets, persistent *-scope API keys, and code execution on workers via POST /v2/inference-backends/from-yaml. It was exploited against a 2.1.1 deployment, where attackers created custom backends running reverse shells.

  • CVE-2026-102894: The SAML callback mints a session from the posted SAMLResponse without verifying its signature. You don’t need SAML configured. Anyone who can reach /auth/saml/callback can sign in as any existing user, admins included.

  • Severity : Critical (CVSS 9.8 / 9.1), CVE-2026-102895 on CISA KEV

  • Affected : CVE-2026-102895: before 2.2.0. CVE-2026-102894: 0.7.1 – before 2.2.2

  • Fixed : 2.2.2 covers both (2.2.0 shipped June 18, 2.2.2 on July 24. Current stable is 2.3.0)

  • Workaround : Set force_auth_localhost=true, strip X-GPUStack-Real-IP at the edge, and block /auth/saml/callback at the proxy. Keep the API on a VPN. API keys created by an attacker keep working after you patch, so audit and revoke admin keys, users and custom inference backends.

Reference : GHSA-gj9m-f8ph-pmhr / GHSA-62m9-f875-rqw6 / NVD CVE-2026-102895

3. FreeSWITCH: One SIP MESSAGE Runs API and OS Commands (Actively Exploited)

CVE-2026-116779 (GHSA-mg63-h38w-8p9p) | Disclosed: October 28, 2026 (vendor advisory); NVD November 5; added to CISA KEV November 9
Project : SignalWire FreeSWITCH (also under FusionPBX and other self-hosted PBX stacks)

Technical Details : For an inbound SIP MESSAGE, FreeSWITCH splits the To user on + and uses the left side to pick a chat protocol. mod_dptools registers an api chat protocol that passes its address to switch_api_execute(), so the sender chooses which FreeSWITCH API command runs. That covers OS commands, config and credential reads, and call control, with mod_lua as a second route. Inbound chat is on by default for the stock internal and external profiles. Any account on the profile is enough, and the stock default directory user with no password can remove even that barrier. SignalWire reports exploitation in the wild.

  • Severity : Critical (CVSS 9.8), on CISA KEV
  • Affected : 1.11.2 and earlier
  • Fixed : 1.11.3 (released August 28)
  • Workaround : Set enable-chat=false on every profile that doesn’t need SIP chat. auth-messages alone isn’t enough. Remove directory users that have no password/a1-hash (stock conf/vanilla ships default and the Skinny example). disable_system_api_commands=true only removes the system API.

Reference : GHSA-mg63-h38w-8p9p / NVD CVE-2026-116779

4. React Server Components: Unauthenticated RCE (Typed Arrays)

CVE-2026-126187 (GHSA-xqc2-xf4c-x3h3) | Disclosed: November 10, 2026
Project : React (react-server-dom-webpack, -parcel, -turbopack)

Technical Details : A crafted payload sent to a framework that supports React Server Components can lead to remote code execution, with no authentication. React says it only hits “extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value”, but it still says to update immediately. It looks like the upstream counterpart of the Next.js use cache typed-array RCE (GHSA-673q-mjm6-r5xr) we covered in the October 22 – 28 summary. That’s our reading, not React’s, but this fix covers every RSC framework and bundler plugin, not just Next.js. Apps that don’t run React on a server, or don’t use an RSC-capable framework/bundler, aren’t affected.

  • Severity : Critical (CVSS v4.0 9.5)
  • Affected : 19.0.0 – 19.0.8, 19.1.0 – 19.1.9, 19.2.0 – 19.2.8, 19.3.0
  • Fixed : 19.0.9, 19.1.10, 19.2.9, 19.3.1
  • Workaround : None. Update the react-server-dom-* package in your lockfile and rebuild images for self-hosted Next.js / RSC dashboards and AI frontends.

Reference : GHSA-xqc2-xf4c-x3h3 / NVD CVE-2026-126187

5. Discourse: Admin Takeover via User API Keys, Automation Template Injection, 2FA Bypass (12 High)

GHSA-6xwm-rw64-6mhg, GHSA-r488-76jc-8jp8, GHSA-65j5-56p7-h6v8 (no CVEs assigned yet) | Disclosed: November 10, 2026
Project : Discourse

Technical Details : Discourse published 38 advisories (12 High, 19 Medium, 7 Low). The worst:

  • GHSA-6xwm-rw64-6mhg: A parameter handling flaw in the User API Key device authorization flow lets a logged-in user authorize a key for a different account and get that user’s access. TL0 users can create user API keys by default on open-registration sites.
  • GHSA-r488-76jc-8jp8: With the Automation plugin, %%KEY%% placeholders (%%TOPIC_TITLE%%, %%POST_QUOTE%%, user names/fields, some %%REPORT=…%%) evaluate template tags in user-written text. Any user can make themselves admin or read secret_key_base.
  • GHSA-65j5-56p7-h6v8: Anyone who knows a deactivated account’s password can skip its 2FA during activation, admins included.

The rest include reading PMs through [quote] comparison (GHSA-vrgg-p6pm-xx4w), cross-group inbox reply bypass (GHSA-rj3x-4hxh-9859, 8.3), scoped API key privilege escalation (GHSA-44qp-4v5j-2rv8), backup-restore symlink and path traversal (GHSA-4xhg-3v3f-8j7x 8.9, GHSA-95q8-2cxf-wrjg 8.7), uploads:gather command injection (GHSA-fv4x-gvp6-f3mc, 8.7) and oauth2-basic callback paths calling Ruby methods (GHSA-w69f-7gf7-8xwj, 8.2).

  • Severity : High (CVSS 8.8 for the API key takeover; batch tops out at v4 8.9)
  • Affected : All versions before the fixed releases below
  • Fixed : 2026.11.0-latest.1, 2026.10.1, 2026.9.2, 2026.7.5
  • Workaround : None for the API key and 2FA issues. Until you rebuild, check Automation scripts that use %%…%% placeholders on user text, keep allow_restore off, and disable oauth2-basic at the deployment level if you don’t use it (turning it off in site settings isn’t enough).

Reference : GHSA-6xwm-rw64-6mhg / GHSA-r488-76jc-8jp8 / GHSA-65j5-56p7-h6v8 / All Discourse advisories

6. Budibase 4.0.0: Anonymous Data Wipe, SSO Takeover, Root RCE (30 Advisories)

GHSA-x4w8-596q-fmh7, GHSA-jm85-crv2-88px, GHSA-5rq2-4mjm-m7q2, GHSA-6wc7-w493-mw5m, CVE-2026-122247 (most have no CVE yet) | Disclosed: November 10, 2026
Project : Budibase (low-code app builder)

Technical Details : 30 advisories in one day, 7 Critical. Highlights:

  • GHSA-x4w8-596q-fmh7: A __proto__ dynamic key in a PUBLIC MongoDB query template wipes the filter, so an unauthenticated caller can run find({}), updateMany({}) or deleteMany({}) on the whole collection. No session or CSRF token needed.

  • GHSA-jm85-crv2-88px: OIDC/SSO account linking accepts email_verified=false for password-less global Builders. An attacker who controls an IdP identity with the victim’s email becomes that Builder, with every app, datasource credential and automation.

  • GHSA-5rq2-4mjm-m7q2: POST /api/automations/:id/test runs automations with no role when the User-Agent is empty or unrecognised.

  • GHSA-6wc7-w493-mw5m: Datasource plugins are still require()d in the main process (incomplete fix of CVE-2026-82244). That’s root on the default Docker image.

  • CVE-2026-122247 (8.2): On single-tenant self-hosted instances, an attacker-chosen tenantId gets past the one-time POST /api/global/users/init guard and creates a new global admin.

  • Severity : Critical (CVSS up to 10.0)

  • Affected : Before 4.0.0

  • Fixed : 4.0.0 (November 10)

  • Workaround : None published. Keep Budibase off the internet until you upgrade, and review PUBLIC queries, plugins and SSO settings.

Reference : GHSA-x4w8-596q-fmh7 / GHSA-jm85-crv2-88px / GHSA-25qc-m4pw-2w8r / All Budibase advisories

7. Rails Active Storage: Upload Extension Picks the Decoder → File Read / RCE

CVE-2026-126186 (GHSA-v924-7rp8-4mxh) | Disclosed: November 10, 2026
Project : Ruby on Rails activestorage (used by many self-hosted Rails apps)

Technical Details : ActiveStorage::Blob#open writes a blob to a tempfile that keeps the uploaded filename’s extension, then passes it to ffprobe/ffmpeg (video/audio analysis and previews) and ImageMagick. Those tools pick a decoder from the extension, so the uploader picks the decoder. With an FFmpeg built with AviSynth, a .avs upload is evaluated as a script. That can leak files through the preview image or load an uploaded native library (RCE). Other extension-selected decoders may be reachable without AviSynth. You’re exposed if you accept untrusted uploads and analyze video/audio (Active Storage does this on attach by default), generate video previews, or process images with ImageMagick. Distro and Homebrew FFmpeg builds don’t enable AviSynth. The ffmpeg.org GPL builds do.

  • Severity : High (CVSS 8.8)
  • Affected : activestorage before 8.0.5.2, and 8.1.0.beta1 – before 8.1.4.1
  • Fixed : 8.0.5.2, 8.1.4.1
  • Workaround : None. Upgrade. Self-hosted Rails apps need a new image from upstream, so watch for releases that bump Rails. If you meet the AviSynth condition, rotate secret_key_base, the master key and every secret the app can read.

Reference : GHSA-v924-7rp8-4mxh

8. Immich: Forced OAuth Linking → Takeover of Any Account (+16 More)

GHSA-7j23-rprg-3g5q (no CVE yet) | Disclosed: November 10, 2026
Project : Immich

Technical Details : POST /api/oauth/authorize needs no auth and copies a caller-supplied state into the immich_oauth_state cookie. POST /api/oauth/link then accepts that cookie as proof the session started the flow. An attacker plants a state they chose in the victim’s browser and sends a callback URL carrying a code for the attacker’s own IdP identity. The victim’s account gets linked to it, and the attacker signs in as the victim. It bypasses the CVE-2025-43856 fix. The same release fixes 16 Medium/Low issues, including arbitrary file read via symlinks in External Library import (GHSA-wp5v-5wj6-j2fh), storage-template path traversal through EXIF fields (GHSA-wwfq-95jq-3m3c) and shared links leaking EXIF/GPS (GHSA-gjj9-fvfp-jw63).

  • Severity : High (CVSS 7.5)
  • Affected : v3.3.6 and earlier
  • Fixed : v3.4.0 (November 10)
  • Workaround : None published. If you don’t use OAuth login, turn it off until you upgrade. Check linked OAuth identities on admin accounts.

Reference : GHSA-7j23-rprg-3g5q / All Immich advisories

9. Vikunja 2.8.0: XML Body Creates Admin Bots, OIDC Email-Fallback Takeover (19 Advisories)

GHSA-fppf-ghrf-8wp7, GHSA-8pm4-w983-mx58 (no CVEs yet) | Disclosed: November 5, 2026
Project : Vikunja

Technical Details :

  • GHSA-fppf-ghrf-8wp7: The v1 API also accepts application/xml bodies, and Go’s XML decoder ignores json:"-" tags. Any logged-in user can create a bot with is_admin=true (instance admin) or set BackgroundFileID to download any stored file: other users’ attachments, avatars and data exports.

  • GHSA-8pm4-w983-mx58: With OIDC emailfallback on, an SSO login gets linked to a local account with the same email, but local emails are never verified when the mailer is off (the default). An attacker registers a local account with the victim’s email, or changes theirs to it, and the victim’s SSO login lands in the attacker’s account. Incomplete fix of CVE-2026-62367.

  • Severity : High (CVSS 8.1 / 7.5)

  • Affected : 0.14.0 – 2.7.1 (XML binding), 1.0.0 – 2.7.1 (OIDC fallback)

  • Fixed : 2.8.0

  • Workaround : Turn off public registration and OIDC emailfallback. Block XML content types to /api/v1 at the proxy until you upgrade.

Reference : GHSA-fppf-ghrf-8wp7 / GHSA-8pm4-w983-mx58

10. Wiki.js: Stored XSS and Permission Bypasses (13 Advisories)

GHSA-35r7-33j8-ghwg, GHSA-6m8p-37cv-c4f5, GHSA-7mf7-wprw-7fjm (no CVEs yet) | Disclosed: November 5 – 9, 2026
Project : Wiki.js (Requarks)

Technical Details : Wiki.js published 13 advisories in five days (5 High):

  • GHSA-35r7-33j8-ghwg: Stored XSS through a javascript: URL in a navigation link (needs manage:navigation). Two more High stored-XSS bugs: the draw.io block’s server property (GHSA-m4c7-x7x7-3ppw) and raw HTML in the markdown preview/live-note reader (GHSA-3c74-j8g3-p255).

  • GHSA-6m8p-37cv-c4f5 (3.2.0): A differently cased folder path skips a folder DENY rule, so users can overwrite protected files and move assets into denied folders.

  • GHSA-7mf7-wprw-7fjm: Folder rename/move/duplicate ignores page rules on descendant pages, which exposes pages the caller isn’t allowed to see.

  • Severity : High (CVSS 8.7 for the navigation XSS)

  • Affected : 2.x up to 2.5.317 for the navigation XSS. 3.2.0 for the asset bypass

  • Fixed : 3.1.0 for the navigation XSS. 3.3.0 for the asset bypass (latest is 3.3.1, November 11). No 2.x fix is listed, so 2.5 users have to move to 3.x.

  • Workaround : Limit manage:navigation and editor rights to trusted users.

Reference : GHSA-35r7-33j8-ghwg / GHSA-6m8p-37cv-c4f5 / All Wiki.js advisories

Key Takeaways This Week

  • Exploited first: OpenSSH SSHole, GPUStack and FreeSWITCH are on CISA’s KEV list (November 9). QNAP also warned that Plex2Shell (CVE-2026-96652/96654/96655/96656, patched this summer) is being used to compromise Plex Media Server on QNAP NAS. Update Plex to 1.43.3+, don’t forward port 32400, and treat internet-exposed Plex boxes as possibly compromised (SecurityWeek).
  • “Behind a proxy” isn’t authentication: GPUStack trusted loopback, which every same-host reverse proxy turns into “everyone”. Check any app that trusts 127.0.0.1 or X-Real-IP/X-Forwarded-For without a trusted-proxy list.
  • Unverified email is still the top SSO bug: Budibase, Vikunja, Immich (OAuth state) and Pocket ID (below) all fixed account linking that trusts something the attacker controls. Pin sub-based linking wherever you can, and turn off email-fallback auto-linking.
  • Alpine is everywhere: SSHole matters most in containers and small VMs you forgot run sshd. Run sshd -T | grep passwordauthentication on every Alpine host and image you build.
  • Rebuild for library bugs: React RSC, Rails Active Storage and Mongoose (CVE-2026-125120, sanitizeFilter skipped on countDocuments, fixed 6.13.11 / 7.8.12 / 8.24.3 / 9.9.2) only reach you through upstream images, so watch your apps’ releases.
  • Also this week: Grafana 13.3.1 / 13.2.6 / 13.1.10 / 13.0.13 / 12.4.15 (November 10) fix six or more CVEs per branch (CVE-2026-102589, -107509 and others), but severities weren’t published when we checked. Docker Engine CVE-2026-115538 (v4 7.0): a firewalld reload removes the iptables rules for encrypted Swarm overlay networks, so traffic goes out in cleartext (fixed 29.9.3). Zulip 12.4 fixes a Dropbox-preview SSRF/server crash (GHSA-c9j8-628c-f7rm, 7.5). Huginn v2026.11.09 stops JqAgent leaking the server environment, APP_SECRET_TOKEN included (GHSA-3f56-748g-q34j). FreshRSS 1.30.0 also fixes an unauthenticated ReDoS (GHSA-g5jg-qcfw-5jpw, 8.2). SiYuan fixes stored XSS → desktop RCE (GHSA-x62v-7955-xx6v, 8.8) in 3.8.11 per the advisory, but the newest release we found was 3.8.10. Woodpecker CI published a High (GHSA-6frq-4g8m-8xw9, 8.1: the clone step’s forge token reachable from pipeline config), fixed back in 3.19.0. Traefik v3.7.18 / v2.11.62 (November 10) add hardening (BasicAuth password length limit, Host matcher validation, dot-segment handling) but no advisory.

Recommendation : Review your self-hosted stack this weekend and prioritize upgrades for any of the above projects you’re running.

Stay secure!

Questions or need config help? Post in Help.

Missed Earlier

This one came out earlier but only reached the GitHub global advisory database this week (November 9), and it wasn’t in an earlier summary.

11. Pocket ID: Old Verification Token Marks Any New Email as Verified

CVE-2026-115770 (GHSA-rm8c-2cv8-jwf6) | Disclosed: July 29, 2026 (added to GitHub Advisory Database November 9)
Project : Pocket ID (passkey-only OIDC provider)

Technical Details : A user requests an email-verification token for an address they control, changes their account email to the victim’s, then redeems the old token. The token is tied to the user ID, not the address, so Pocket ID marks the victim’s address verified and sends email_verified: true in OIDC claims. Any relying app that links or provisions accounts by verified email will hand the attacker the victim’s account. It works on default settings (emailsVerified=false, allowOwnAccountEdit=true) with no admin rights or victim interaction. A second advisory added the same day, CVE-2026-62662 (GHSA-q4xm-p75h-h9p3, 7.7, fixed 2.10.0), lets any OIDC client get client-credentials tokens for any audience, including other clients.

  • Severity : Critical (CVSS 9.6)
  • Affected : Before v2.12.0
  • Fixed : v2.12.0 (latest is v2.19.2, November 2)
  • Workaround : Turn off allowOwnAccountEdit, and make relying apps link on sub, not email.

Reference : GHSA-rm8c-2cv8-jwf6 / GHSA-q4xm-p75h-h9p3

The conversation

Open in the community ↗

Have a thought or a question? Join the discussion below with your community account.