🚨 Weekly Self-Hosted Security Summary (October 22 – October 28, 2026)

🚨→Security Advisory→🚨
, , ,
1

Weekly Self-Hosted Security Summary (October 22 – October 28, 2026)

Here’s a roundup of 10 critical/high security issues disclosed this week affecting popular open-source self-hosted projects, plus 3 earlier advisories for GitLab, Next.js and MLflow we hadn’t covered yet (see Missed Earlier). Patch quickly: the Brotli “Node2Shell” bug and Nextcloud’s built-in Collabora CODE server are both being exploited in the wild, and LiteLLM has a CVSS 10.0 unauthenticated key leak.

1. Brotli “Node2Shell”: Decoder Out-of-Bounds Write → Remote Code Execution (Now Actively Exploited)

CVE-2026-111497 | Disclosed: October 21, 2026 (PyPI advisory October 22; added to CISA KEV October 27)
Project : Google Brotli (bundled in Node.js; also the PyPI brotli / brotlicffi packages)

Technical Details : When a Brotli stream signals a block switch that its own structure makes invalid, the decoder treats it as “need more input” instead of a format error and keeps appending bytes to an 8-byte internal buffer, writing past its end. Anyone who can get your app to decompress Brotli data can corrupt process memory: crash, memory disclosure or RCE, no authentication needed. In Node.js you don’t have to call the Brotli API yourself to be exposed: fetch() decompresses br responses automatically, and Express 5 / body-parser 2 decompress Content-Encoding: br request bodies by default (inflate: true). CISA added it to the Known Exploited Vulnerabilities catalog on October 27.

  • Severity : Critical (CVSS v4.0 9.2). Node.js itself rates it High
  • Affected : Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1 (EOL lines 20.x, 23.x, 25.x get no fix). PyPI brotli 1.0.3 – 1.2.0, brotlicffi 1.0.3 – before 1.2.1.0
  • Fixed : Node.js 22.23.4, 24.22.1, 26.12.1. Brotli 1.0.10, 1.1.1, 1.2.1. PyPI brotli 1.2.1, brotlicffi 1.2.1.0
  • Workaround : None from Node.js. Upgrade is the fix. If you don’t need compressed request bodies, set body-parser inflate: false. Rebuild images that bundle Node or Python Brotli, and apply distro nodejs/brotli updates.

Reference : Node.js October 2026 Security Releases / GHSA-9v8h-qqgm-4m35 / CISA KEV alert (Oct 27) / Akamai analysis

2. Nextcloud “Collabora Online – Built-in CODE Server” Command Injection (Now Actively Exploited)

CVE-2026-110447 | Disclosed: October 14, 2026 (added to CISA KEV October 23)
Project : Collabora Online Built-in CODE Server (richdocumentscode Nextcloud app)

Technical Details : Unauthenticated OS command injection in the app’s proxy.php, reachable when the bundled CODE server isn’t running (for example right after a restart, upgrade or crash). Commands run as the web server user. Admins reported attacks from September 10 onward: PHP web shells dropped in the app directory, then searches for password-manager databases and crypto wallets. CISA added it to KEV on October 23. Only the bundled richdocumentscode app is affected. Standalone Collabora Online (Docker, DEB/RPM) used through the Nextcloud Office (richdocuments) connector is not.

  • Severity : Critical (CVSS 9.8 v3.1 / 9.2 v4.0)
  • Affected : richdocumentscode before 26.4.303
  • Fixed : 26.4.303 (needs Nextcloud 30 or later)
  • Workaround : Upgrade or remove the app. Collabora says disabling it is not enough. Patching doesn’t remove a web shell: check apps/richdocumentscode for unexpected PHP files (Nextcloud’s integrity check helps), search access logs for odd proxy.php requests, and rotate secrets if you find anything.

Reference : GHSA-f97p-r72q-64h2 / NVD — CVE-2026-110447 / BleepingComputer

3. LiteLLM Proxy Unauthenticated File Read Leaks the Master Key

GHSA-w4c7-34wj-hqm8 (no CVE assigned yet) | Disclosed: October 27, 2026
Project : LiteLLM (BerriAI)

Technical Details : On a proxy running with an Enterprise license, an unauthenticated request to any LLM route can make the proxy read a local file and POST its contents to an attacker-chosen URL. Reading /proc/self/environ gives up LITELLM_MASTER_KEY and your provider API keys, which means full admin on the proxy and, in some configurations, Python code execution as root. Open-source deployments without a license are not affected. A second advisory the same day, GHSA-7hp6-4w63-5g45 / CVE-2026-114612 (CVSS 9.9), lets a user escalate to proxy admin through cross-domain reuse of the salt key.

  • Severity : Critical (CVSS 10.0)
  • Affected : Before 1.103.10, 1.104.8, 1.105.6, 1.106.5 on their respective lines
  • Fixed : 1.103.10, 1.104.8, 1.105.6, 1.106.5 (CVE-2026-114612: 1.100.4, 1.101.3, 1.102.2, 1.103.1)
  • Workaround : At the edge, reject or strip POST bodies containing the JSON keys standard_callback_dynamic_params, gcs_path_service_account, callbacks, success_callback or failure_callback. Restrict the proxy’s outbound traffic to your LLM providers. Load the master key from a secret manager and set a separate LITELLM_SALT_KEY. If you were exposed, rotate the master key and provider keys.

Reference : GHSA-w4c7-34wj-hqm8 / GHSA-7hp6-4w63-5g45

4. Portainer: Standard Users Can Grab Host Bind Mounts (Docker Socket) via volumes_from

GHSA-j3mf-q9qf-5qf8 (no CVE assigned yet) | Disclosed: October 22, 2026
Project : Portainer CE / BE

Technical Details : The “Hide bind mounts for non-administrators” check inspects a stack’s volumes but never volumes_from. A Standard user with access to a Docker environment can deploy a Compose stack that inherits the mounts of an existing container that has host bind mounts. On the documented Server and Agent setups, that includes the Docker socket and Portainer’s data directory, which means full control of the Docker host. Docker standalone is affected. Two Medium Portainer advisories came out the same day (GHSA-wc8m-r885-8pj3, GHSA-7423-r5wh-26x7).

  • Severity : Critical (CVSS v4.0 9.4)
  • Affected : 2.39.0 and later, through 2.45.2 (CE and BE)
  • Fixed : 2.45.3. The 2.39.x LTS line gets no patch, and 2.40 – 2.44 are EOL. Move to 2.45.3.
  • Workaround : Enable “Hide the use of Stacks for non-administrators” per environment. Only give Standard users environments where you’d trust them with host-level access. Audit existing non-admin stacks for volumes_from.

Reference : GHSA-j3mf-q9qf-5qf8

5. Outline: Account Takeovers via SSO/OAuth (36-Advisory Batch)

GHSA-48rq-wx9j-g949, GHSA-f28f-75h4-499q, GHSA-m9vh-j2wc-xj24 (no CVEs assigned yet) | Disclosed: October 24, 2026
Project : Outline (wiki/knowledge base)

Technical Details : Outline published 36 advisories in one day (2 Critical, 11 High). The worst are login takeovers:

  • GHSA-48rq-wx9j-g949: userProvisioner matches existing logins by providerId alone, but those IDs are only unique within one provider. A colliding ID from a different SSO/OIDC provider signs in as the existing user.
  • GHSA-f28f-75h4-499q: With Azure SSO and AZURE_TENANT_ID unset (the default multi-tenant mode), an attacker sets the mail attribute in their own free Entra tenant to the victim’s address and signs in as the victim. No victim interaction.
  • GHSA-m9vh-j2wc-xj24: The Azure and Discord adapters trust the provider’s email without checking its verified flag, then merge into the existing user. The attacker’s identity stays linked to the victim’s account.

The rest of the batch includes stored XSS (GHSA-w826-vphp-43r6, CVSS 8.7) and other High issues fixed in 1.9.0 – 1.12.0.

  • Severity : Critical (GHSA-48rq, GHSA-f28f). The advisory text for GHSA-48rq gives CVSS 3.1 9.1; GHSA-f28f has no published score. GHSA-m9vh: High (CVSS 8.3)
  • Affected : Before 1.11.0 (one High issue, GHSA-rq53-m97j-f2pg, before 1.12.0)
  • Fixed : 1.12.0 covers the whole batch
  • Workaround : If you use Azure SSO, set AZURE_TENANT_ID to your own tenant. Until patched, turn off the Discord and Azure providers if you don’t need them.

Reference : Outline Security Advisories / GHSA-48rq-wx9j-g949 / GHSA-f28f-75h4-499q / GHSA-m9vh-j2wc-xj24

6. Atlantis: Forged Webhook → Fork-Protection Bypass → Remote Code Execution

GHSA-6mjf-4m52-m5cq (no CVE assigned yet) | Disclosed: October 25, 2026
Project : Atlantis (Terraform PR automation)

Technical Details : Atlantis checks the path of a PR’s clone URL but not the host, and the fork check trusts the head repo name from the same webhook payload. An attacker can point Atlantis at their own git server and have it fetch and plan a Terraform tree they control. --allow-fork-prs=false sees a same-repo PR and lets it through, and the spoofed name also passes --repo-allowlist. With no GitHub webhook secret set, one forged webhook is enough, unauthenticated. It shipped with 11 more advisories (7 High), all fixed in the same release.

  • Severity : Critical (CVSS 9.8)
  • Affected : Before 0.49.0
  • Fixed : 0.49.0
  • Workaround : Configure a webhook secret now, and don’t expose the Atlantis events endpoint beyond your VCS provider’s IP ranges.

Reference : GHSA-6mjf-4m52-m5cq / Atlantis Security Advisories

7. GLPI: Unauthenticated SQL Injection Plus 9 More High-Severity Fixes

GHSA-753w-2942-4pxm (no CVE assigned yet) | Disclosed: October 26, 2026
Project : GLPI (IT asset management / helpdesk)

Technical Details : An unauthenticated user can run a time-based SQL injection against the planning feature. The same release fixes nine other High issues, including two MFA bypasses (GHSA-3rr2-mxv6-rmc2, GHSA-rvrc-4jr9-wm5c), a malicious page upload (GHSA-pr87-h373-xr6c) and a marketplace race condition (GHSA-hv93-qr6v-7mpj).

  • Severity : High (CVSS v4.0 8.7 for the SQLi; the batch ranges 7.5 – 8.9)
  • Affected : SQLi: 11.0.8. Other issues reach back into 10.0.x and older (e.g. 9.3.0+ / 9.5.0+)
  • Fixed : 11.0.9 (11.x), 10.0.27 (10.x)
  • Workaround : Upgrade. Keep GLPI off the public internet or behind an authenticating proxy.

Reference : GHSA-753w-2942-4pxm / GLPI Security Advisories

8. n8n: Sandbox Escapes and Code Execution in the Main Process

GHSA-gx3v-3x3v-f8r5, GHSA-9p7v-45m2-wxgj, GHSA-f2cw-9483-7vcp (no CVEs assigned yet) | Disclosed: October 28, 2026
Project : n8n

Technical Details : A new batch of 12 advisories (3 High, 9 Medium), separate from last week’s:

  • GHSA-gx3v-3x3v-f8r5: A user who can edit workflows can escape expression-evaluation isolation and run code on the host.

  • GHSA-9p7v-45m2-wxgj: The deprecated Function / Function Item nodes (vm2) and the LangChain Code node run user code in the n8n main process, outside task-runner isolation. Fixed versions block these nodes by default. Existing workflows keep running, so replace them with the Code node. N8N_DEPRECATED_NODES_BLOCK=false brings the hole back.

  • GHSA-f2cw-9483-7vcp: The GraphicsMagick bundled in the official Docker image has known bugs. Untrusted images fed to the Edit Image node can lead to RCE.

  • Severity : High (CVSS v4.0 8.7 for GHSA-9p7v; 7.7 for the other two)

  • Affected : Before 1.123.89, 2.45.5, 2.46.1, 3.0.1 (GHSA-9p7v: before 2.42.6, 2.43.3, 3.0.1)

  • Fixed : 1.123.89, 2.45.5, 2.46.1, 3.0.1 (GHSA-9p7v also 2.42.6, 2.43.3)

  • Workaround : Limit workflow editing to trusted users. Don’t wire an unauthenticated Webhook straight into an Edit Image node. Use NODES_EXCLUDE to drop nodes you don’t use.

Reference : n8n Security Advisories / GHSA-gx3v-3x3v-f8r5 / GHSA-9p7v-45m2-wxgj / GHSA-f2cw-9483-7vcp

9. Nextcloud: Unauthenticated Persistent DoS via Federated Share Injection

CVE-2026-77167 | Disclosed: October 27, 2026
Project : Nextcloud Server / Enterprise Server

Technical Details : An unauthenticated attacker can abuse the federated share endpoint to write arbitrary rows into oc_share_external. Nothing cleans those rows up. They trigger three separate denial-of-service conditions that renew themselves every 24 hours until the rows are removed. Nextcloud published 9 more Medium/Low advisories the same day.

  • Severity : High (CVSS 7.5)
  • Affected : Nextcloud Server before 34.0.2, 33.0.7, 32.0.13 (Enterprise back to 22.x)
  • Fixed : Server 34.0.2, 33.0.7, 32.0.13. Enterprise also gets fixes back to 22.2.11 / 22.2.10.42 (see advisory)
  • Workaround : Disable receiving federated shares.

Reference : GHSA-5572-968j-v7g5

10. FreshRSS 1.30.0: Login as Any User + PHP Object Injection

GHSA-8pvw-w7w8-vjj7, GHSA-rv9c-qhwg-9j55 (no CVEs assigned yet) | Disclosed: October 21 and October 24, 2026
Project : FreshRSS

Technical Details :

  • GHSA-8pvw-w7w8-vjj7 (October 21, after last week’s cut-off): Form login calls password_verify() with the browser-supplied challenge as the hash argument. Since PHP accepts legacy crypt() formats, an attacker can downgrade to DES and log in as any user without the password.
  • GHSA-rv9c-qhwg-9j55 (October 24): One feed kind has no case in cacheFilename(), so FreshRSS writes the raw downloaded page into SimplePie’s serialized .spc cache, which is later passed to unserialize(). Any user who can add a feed gets PHP object injection.

Two more High issues (GHSA-cgqh-mxr9-mx7h, GHSA-94h5-9h74-7c4q) are fixed in the same release.

  • Severity : Critical (CVSS 9.8) for the auth bypass. High (CVSS 8.8) for the object injection
  • Affected : Auth bypass: 1.11.0 – 1.29.1. Object injection: before 1.30.0
  • Fixed : 1.30.0
  • Workaround : Upgrade. Until then, use reverse-proxy/HTTP auth instead of form login, and don’t let untrusted users add feeds.

Reference : GHSA-8pvw-w7w8-vjj7 / GHSA-rv9c-qhwg-9j55

Key Takeaways This Week

  • Exploited first: Node2Shell (Brotli) and Nextcloud’s built-in CODE server are on CISA’s KEV list. CISA also added last week’s PHP2Shell bugs (CVE-2026-109618/109619) to KEV on October 26, so if PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 isn’t on every box yet, do it today.
  • Rebuild images, not just apps: Brotli lives inside Node.js and Python images. A docker compose pull only helps once upstream has rebuilt, so check the Node version inside the container.
  • SSO is only as good as its email check: Outline trusted unverified Azure/Discord emails, and GitLab’s release (below) fixes an OmniAuth-to-LDAP account takeover. Pin your IdP tenant and check what your apps trust.
  • Least-privilege users aren’t least-privilege: Portainer Standard users, n8n workflow editors and GLPI planning (no login at all) all lead to host or database access. Audit who has accounts.
  • Unsigned webhooks are an open door: Atlantis with no webhook secret is unauthenticated RCE. Every webhook receiver you run should verify signatures.
  • AI/ML tooling is now a target: LiteLLM, MLflow and Next.js-based AI frontends all had critical unauthenticated bugs. Don’t expose these to the internet without auth in front.
  • Already on Nginx UI 2.9.0? Ten more advisories published October 22 (including cert_sync arbitrary conf writes) are all fixed in 2.9.0, the version we recommended last week. Grafana 12.4.14 / 13.2.5 / 13.3.0 (October 27) are Medium-only fixes. Discourse fixed an MCP private-message scope gap (CVSS 7.7) in 2026.10.0-latest.1 / 2026.9.1 / 2026.8.2 / 2026.7.4.

Recommendation : Review your self-hosted stack this weekend and prioritize upgrades for any of the above projects you’re running.

Stay secure!

Questions or need config help? Post in Help .

Missed Earlier

These came out before this week and weren’t in an earlier summary. They’re all critical, unauthenticated and in widely self-hosted software.

11. GitLab CE/EE: Unauthenticated RCE in the Regular Expression Compiler (Back to 7.0)

CVE-2026-110264 | Disclosed: October 21, 2026
Project : GitLab Community / Enterprise Edition

Technical Details : An integer overflow when compiling a crafted regular expression lets an unauthenticated user run code on the GitLab server. It affects every release since 7.0 (2014), and GitLab backported the fix to four older branches. GitLab has published two detection rules (“Onigmo native worker crash”, “Org mode render error burst”). The same release fixes CVE-2026-15723 (CVSS 8.2, OmniAuth SAML + LDAP auto-link account takeover) and CVE-2026-112212 (CVSS 7.5, OAuth/OIDC discovery cache poisoning). This is a different bug from the October 12 regex RCE (19.4.2) we covered earlier.

  • Severity : Critical (CVSS 10.0)
  • Affected : 7.0 – before 18.11.13, 19.0 < 19.0.10, 19.1 < 19.1.9, 19.2 < 19.2.9, 19.3 < 19.3.6, 19.4 < 19.4.3, 19.5 < 19.5.1
  • Fixed : 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (19.5.2 followed on October 27)
  • Workaround : None. Upgrade, then check logs against GitLab’s detection rules.

Reference : GitLab Critical Patch Release 19.5.1 / CERT-EU 2026-019

12. Next.js: Two Unauthenticated RCEs (Image Optimization SVG + use cache)

CVE-2026-96889 (GHSA-2464-fhr4-w9xw), GHSA-673q-mjm6-r5xr (no CVE yet for the second) | Disclosed: October 14, 2026
Project : Next.js (Vercel). Used by many self-hosted dashboards and AI frontends

Technical Details :

  • GHSA-2464-fhr4-w9xw: The Image Optimization API passes SVGs to sharp, whose memory bug on glibc Linux gives unauthenticated RCE.
  • GHSA-673q-mjm6-r5xr: In App Router Cache Components, a use cache function that returns multiple typed arrays can be abused for unauthenticated RCE.

A third advisory (GHSA-p3m5-59mp-jv5r / CVE-2026-94482, High) is a Server Actions DoS.

  • Severity : Critical (CVSS v4.0 9.5, both)
  • Affected : SVG/sharp: 10.0.0 – 15.5.27 and 16.0.0 – 16.4.0. use cache: 16.0.0 – 16.4.0
  • Fixed : 15.5.28, 16.4.1
  • Workaround : For the SVG issue, make sure the resolved sharp is 0.35.5 or later (check your lockfile on 15.5.28). The use cache issue has no workaround.

Reference : Next.js Security Update / GHSA-2464-fhr4-w9xw / GHSA-673q-mjm6-r5xr

13. MLflow: Unauthenticated RCE via Third-Party Scorer Deserialization

CVE-2026-116692 | Disclosed: October 09, 2026 (added to the GitHub Advisory Database October 27)
Project : MLflow

Technical Details : Since 3.12.0, the server imports a request-controlled module path when it deserializes a third-party scorer. Using MLflow’s own experiment, run and artifact-upload endpoints, an attacker uploads a Python module into an allowed package path and triggers it through /ajax-api/3.0/mlflow/scorer/invoke. On the default no-auth server, that is unauthenticated code execution. The official image runs as uid 0. Also fixed: CVE-2026-116690 (CVSS 7.5, file read).

  • Severity : Critical (CVSS 9.8)
  • Affected : 3.12.0rc0 – before 3.17.0
  • Fixed : 3.17.0
  • Workaround : Never expose an MLflow server without authentication in front of it, and don’t run it as root.

Reference : GHSA-26p8-2jq9-3vq9

1 Like