# 🚨 Weekly Self-Hosted Security Summary (October 08 – October 14, 2026)

**URL:** <https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-08-october-14-2026/4506>\
**Category:** 🚨→Security Advisory→🚨\
**Tags:** security, self-hosted, cve, weekly-security\
**Created:** [October 14, 2026, 2:18pm UTC](https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-08-october-14-2026/4506 "2026-10-14T14:18:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [October 14, 2026, 2:18pm UTC](https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-08-october-14-2026/4506/1 "2026-10-14T14:18:08Z")

</div>

**Weekly Self-Hosted Security Summary (October 08 – October 14, 2026)**

Here’s a roundup of **9 critical/high security issues** disclosed or materially updated this week affecting popular open-source self-hosted projects. Patch quickly — GitLab has public exploit references.

* * *

### **1. GitLab CI/CD Regex Validation → Remote Code Execution**

**CVE-2026-97229** | Disclosed: October 12, 2026 (critical patch release); CVE published October 13, 2026  
**Project** : GitLab CE/EE

**Technical Details** : Insufficient validation of regular expressions in CI/CD configuration can, under certain conditions, let an unauthenticated user execute arbitrary code on the GitLab server. Exploit references (HackerOne reports) are public. The same patch release fixes a long list of authorization, SSRF and cache-poisoning issues.

- **Severity** : Critical (CVSS 10.0)
- **Affected** : 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2
- **Fixed** : 19.4.2, 19.3.5, 19.2.8
- **Workaround** : Upgrade now. Until then, restrict who can modify `.gitlab-ci.yml`, disable pipelines for untrusted/fork contributors and keep the instance behind VPN or an IP allowlist.

**Reference** : [GitLab Critical Patch Release 19.4.2 / 19.3.5 / 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)

### **2. HAProxy Data Plane API Authentication Bypass**

**CVE-2026-109575** | Disclosed: October 12, 2026  
**Project** : HAProxy Data Plane API

**Technical Details** : When `tls_ca` and a numeric `tls_port` are configured, Basic auth is disabled globally on a handler shared by the HTTP, HTTPS and UNIX socket listeners, while mTLS is only enforced on HTTPS. Any other active listener fails open, so an unauthenticated attacker can read or replace the full HAProxy configuration through the raw configuration endpoint.

- **Severity** : Critical (CVSS 9.8)
- **Affected** : 2.2.0 through 3.4.3 (and matching EE releases), only in mTLS setups with a concurrent non-mTLS listener
- **Fixed** : 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29 and EE backports
- **Workaround** : Disable the plain HTTP listener or bind it to 127.0.0.1, lock down UNIX socket permissions and firewall the management port.

**Reference** : [GitHub Advisory GHSA-7jqw-rhp8-c8vf / NVD — CVE-2026-109575](https://nvd.nist.gov/vuln/detail/CVE-2026-109575)

### **3. Traefik Ingress-NGINX mTLS Bypass via TLS Option Conflict**

**CVE-2026-85596** | CVE published: October 08, 2026  
**Project** : Traefik

**Technical Details** : In the Kubernetes Ingress NGINX provider, two Ingresses for the same host with the same `auth-tls-secret` get different generated TLS option names. Traefik treats that as a conflict and falls back to the default TLS config, which does not request a client certificate, so routes set to `auth-tls-verify-client: "on"` become reachable without one. Traefik also published a batch of other high-severity advisories on October 07 (Ingress-NGINX auth/header issues, NTLM/Negotiate connection-pool leaks, SNI check bypass).

- **Severity** : High (CVSS 8.2)
- **Affected** : v3.7.0 – v3.7.10 (only the v3.7 line)
- **Fixed** : v3.7.11
- **Workaround** : Avoid splitting an mTLS-protected host across multiple Ingress objects until upgraded.

**Reference** : [Traefik Security Advisory GHSA-j994-9gqj-9hwq](https://github.com/traefik/traefik/security/advisories/GHSA-j994-9gqj-9hwq)

### **4. Grav CMS Nested `.git` Exposure**

**CVE-2026-109326** | Disclosed: October 12, 2026  
**Project** : Grav

**Technical Details** : The bundled nginx, lighttpd, IIS and Caddy 2 configs block `.git` only at the document root. Nested repositories such as `/user/.git/` stay web-readable, letting unauthenticated attackers pull config, refs and objects and rebuild history or committed secrets.

- **Severity** : High (CVSS 8.7)
- **Affected** : All versions before 2.1.7 using the bundled web-server configs
- **Fixed** : 2.1.7
- **Workaround** : Make the dotfile deny rule recursive (e.g. nginx `location ~ /\.(?!well-known/) { deny all; }`), move repos out of the webroot, and rotate any secrets ever committed.

**Reference** : [Grav Security Advisory GHSA-5vx9-x8f2-f55w](https://github.com/getgrav/grav/security/advisories/GHSA-5vx9-x8f2-f55w)

### **5. Astron Agent Unsandboxed Code Node → Root RCE**

**CVE-2026-108263** | Disclosed: October 09, 2026  
**Project** : Astron Agent (iFlytek)

**Technical Details** : The default config routes workflow Code nodes to `LocalExecutor`, which exposes full Python builtins with no sandbox. A low-privilege tenant can run code as root in the core-workflow container, grab shared service and database credentials, and read or modify other tenants’ data.

- **Severity** : Critical (CVSS 9.9)
- **Affected** : All versions before 1.1.2
- **Fixed** : 1.1.2
- **Workaround** : Set `CODE_EXEC_TYPE` away from the local executor and restrict who can create workflows with Code nodes; rotate shared credentials after upgrading.

**Reference** : [vuln.today — CVE-2026-108263](https://vuln.today/cve/CVE-2026-108263)

### **6. FalkorDB Bolt WebSocket Heap Overflow**

**CVE-2026-107909** | Disclosed: October 09, 2026  
**Project** : FalkorDB

**Technical Details** : `ws_read_frame` doesn’t bound the 64-bit WebSocket payload length, and the only check in `buffer_apply_mask` is an `ASSERT()` compiled out of release builds. An unauthenticated attacker can XOR heap memory past the receive buffer, crashing the server and possibly corrupting memory.

- **Severity** : High (CVSS 8.8)
- **Affected** : All versions before 4.20.0, only when the Bolt endpoint (`BOLT_PORT`) is enabled (off by default)
- **Fixed** : 4.20.0
- **Workaround** : Leave `BOLT_PORT` unset or firewall the Bolt port.

**Reference** : [NVD — CVE-2026-107909](https://nvd.nist.gov/vuln/detail/CVE-2026-107909)

### **7. Handlebars Prototype Deny-List Bypass → RCE**

**CVE-2026-106445** | Disclosed: October 08, 2026 (GitHub advisory)  
**Project** : Handlebars (Node.js templating, used by many self-hosted apps)

**Technical Details** : `lookupProperty` trusts own properties of prototype objects, so `constructor` on `Function.prototype` skips the deny list. With `allowProtoMethodsByDefault: true`, an attacker who controls a template can reach the `Function` constructor and run arbitrary JavaScript on the server.

- **Severity** : Critical (CVSS 9.2)
- **Affected** : 3.0.0 – 4.7.9
- **Fixed** : 4.7.10
- **Workaround** : Don’t enable `allowProtoMethodsByDefault`, and never render untrusted templates. Check app dependency trees and rebuild images.

**Reference** : [GitHub Advisory GHSA-p8wg-vrv2-v86f](https://github.com/advisories/GHSA-p8wg-vrv2-v86f)

### **8. Wazuh Cluster Upload Path Traversal → Arbitrary File Write**

**CVE-2026-74043** | Disclosed: October 13, 2026  
**Project** : Wazuh Manager

**Technical Details** : Cluster-callable upload helpers (`upload_list_file`, `upload_rule_file`, `upload_decoder_file`) build destination paths from a caller-supplied `filename` without their own traversal checks. Validation exists only in the REST controller, so a malicious or compromised cluster worker can reach those helpers through DistributedAPI with `../` sequences and write arbitrary files as the `wazuh` user. This is the same write primitive previously fixed for cluster file-sync (`receive_file`), reached via a path that fix did not cover.

- **Severity** : Critical (CVSS 9.0)
- **Affected** : 4.1.1 before 4.14.8
- **Fixed** : 4.14.8
- **Workaround** : Treat the cluster key as a full trust boundary, isolate worker-to-master traffic, and upgrade managers before adding untrusted workers.

**Reference** : [Wazuh Security Advisory GHSA-cw26-jj8q-x7w5](https://github.com/wazuh/wazuh/security/advisories/GHSA-cw26-jj8q-x7w5)

### **9. ONLYOFFICE Document Builder → Authenticated RCE**

**CVE-2026-110385** | Disclosed: October 14, 2026  
**Project** : ONLYOFFICE Document Server

**Technical Details** : An attacker who can present a valid Inbox-compatible JWT can abuse Document Builder’s `builder.SaveFile()` optional converter XML. Injecting a duplicate `m_sFileTo` element overrides the server-generated output path, enabling writes outside the job directory. Overwriting `runtime.json` then lets a later Builder job run attacker-chosen commands as the `ds` service account. Many installs leave inbound JWT validation off or reuse a weak/shared inbox secret, which lowers the bar for minting that token.

- **Severity** : High (CVSS 8.7)
- **Affected** : All Document Server versions before 10.0.0
- **Fixed** : 10.0.0
- **Workaround** : Upgrade to 10.0. Enable inbound JWT validation with a strong private inbox secret, and restrict network access so only your front-end app can reach Document Server.

**Reference** : [Tenable / CVE — CVE-2026-110385](https://www.tenable.com/cve/CVE-2026-110385)

* * *

## **Key Takeaways This Week**

- **GitLab is the top priority** : a CVSS 10.0 pre-auth RCE with public exploit references. Self-managed instances should be on **19.4.2 / 19.3.5 / 19.2.8** now (19.3.4 is not the security target — GitLab shipped 19.3.5 after a merge-request bug in 19.3.4).
- **mTLS setups failing open is still a theme** : HAProxy Data Plane API and Traefik both drop client-cert enforcement in specific multi-listener / multi-Ingress configs. Test that your mTLS routes actually reject requests without a cert.
- **Cluster and document engines need the same urgency as public apps** : Wazuh’s cluster upload path and ONLYOFFICE’s Document Builder both turn “internal” trust into arbitrary write or RCE.
- **Bundled configs aren’t a security boundary** : Grav’s shipped web-server configs left nested `.git` directories exposed. Audit your reverse proxy rules for dotfiles.
- **Check dependencies, not just apps** : Handlebars 4.7.10 (CVSS 9.2) needs to land in the images of apps that bundle it.

**Recommendation** : Review your self-hosted stack this weekend and prioritize upgrades for any of the above projects you’re running.

Stay secure!

_Questions or need config help? Post in Help ._