# 🚨 Weekly Self-Hosted Security Summary (October 22 – October 28, 2026)

**URL:** <https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-22-october-28-2026/4606>\
**Category:** 🚨→Security Advisory→🚨\
**Tags:** self-hosted, cve, weekly-security, security\
**Created:** [October 28, 2026, 2:09pm UTC](https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-22-october-28-2026/4606 "2026-10-28T14:09:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [October 28, 2026, 2:09pm UTC](https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-22-october-28-2026/4606/1 "2026-10-28T14:09:53Z")

</div>

**Weekly Self-Hosted Security Summary (October 22 – October 28, 2026)**

Here’s a roundup of **10 critical/high security issues** disclosed this week affecting popular open-source self-hosted projects, plus **3 earlier advisories for GitLab, Next.js and MLflow** we hadn’t covered yet (see _Missed Earlier_). Patch quickly: the Brotli “Node2Shell” bug and Nextcloud’s built-in Collabora CODE server are both being exploited in the wild, and LiteLLM has a CVSS 10.0 unauthenticated key leak.

* * *

### **1. Brotli “Node2Shell”: Decoder Out-of-Bounds Write → Remote Code Execution (Now Actively Exploited)**

**CVE-2026-111497** | Disclosed: October 21, 2026 (PyPI advisory October 22; added to CISA KEV October 27)  
**Project** : Google Brotli (bundled in Node.js; also the PyPI `brotli` / `brotlicffi` packages)

**Technical Details** : When a Brotli stream signals a block switch that its own structure makes invalid, the decoder treats it as “need more input” instead of a format error and keeps appending bytes to an 8-byte internal buffer, writing past its end. Anyone who can get your app to decompress Brotli data can corrupt process memory: crash, memory disclosure or RCE, no authentication needed. In Node.js you don’t have to call the Brotli API yourself to be exposed: `fetch()` decompresses `br` responses automatically, and Express 5 / body-parser 2 decompress `Content-Encoding: br` request bodies by default (`inflate: true`). CISA added it to the Known Exploited Vulnerabilities catalog on October 27.

- **Severity** : Critical (CVSS v4.0 9.2). Node.js itself rates it High
- **Affected** : Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1 (EOL lines 20.x, 23.x, 25.x get no fix). PyPI `brotli` 1.0.3 – 1.2.0, `brotlicffi` 1.0.3 – before 1.2.1.0
- **Fixed** : Node.js 22.23.4, 24.22.1, 26.12.1. Brotli 1.0.10, 1.1.1, 1.2.1. PyPI `brotli` 1.2.1, `brotlicffi` 1.2.1.0
- **Workaround** : None from Node.js. Upgrade is the fix. If you don’t need compressed request bodies, set body-parser `inflate: false`. Rebuild images that bundle Node or Python Brotli, and apply distro `nodejs`/`brotli` updates.

**Reference** : [Node.js October 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) / [GHSA-9v8h-qqgm-4m35](https://github.com/advisories/GHSA-9v8h-qqgm-4m35) / [CISA KEV alert (Oct 27)](https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog) / [Akamai analysis](https://www.akamai.com/blog/security-research/inside-node2shell-closer-look-cve-2026-111497)

* * *

### **2. Nextcloud “Collabora Online – Built-in CODE Server” Command Injection (Now Actively Exploited)**

**CVE-2026-110447** | Disclosed: October 14, 2026 (added to CISA KEV October 23)  
**Project** : Collabora Online Built-in CODE Server (`richdocumentscode` Nextcloud app)

**Technical Details** : Unauthenticated OS command injection in the app’s `proxy.php`, reachable when the bundled CODE server isn’t running (for example right after a restart, upgrade or crash). Commands run as the web server user. Admins reported attacks from September 10 onward: PHP web shells dropped in the app directory, then searches for password-manager databases and crypto wallets. CISA added it to KEV on October 23. Only the bundled `richdocumentscode` app is affected. Standalone Collabora Online (Docker, DEB/RPM) used through the Nextcloud Office (`richdocuments`) connector is not.

- **Severity** : Critical (CVSS 9.8 v3.1 / 9.2 v4.0)
- **Affected** : `richdocumentscode` before 26.4.303
- **Fixed** : 26.4.303 (needs Nextcloud 30 or later)
- **Workaround** : Upgrade or **remove** the app. Collabora says disabling it is not enough. Patching doesn’t remove a web shell: check `apps/richdocumentscode` for unexpected PHP files (Nextcloud’s integrity check helps), search access logs for odd `proxy.php` requests, and rotate secrets if you find anything.

**Reference** : [GHSA-f97p-r72q-64h2](https://github.com/advisories/GHSA-f97p-r72q-64h2) / [NVD — CVE-2026-110447](https://nvd.nist.gov/vuln/detail/cve-2026-110447) / [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/)

* * *

### **3. LiteLLM Proxy Unauthenticated File Read Leaks the Master Key**

**GHSA-w4c7-34wj-hqm8** (no CVE assigned yet) | Disclosed: October 27, 2026  
**Project** : LiteLLM (BerriAI)

**Technical Details** : On a proxy running with an **Enterprise license** , an unauthenticated request to any LLM route can make the proxy read a local file and POST its contents to an attacker-chosen URL. Reading `/proc/self/environ` gives up `LITELLM_MASTER_KEY` and your provider API keys, which means full admin on the proxy and, in some configurations, Python code execution as root. Open-source deployments without a license are not affected. A second advisory the same day, **GHSA-7hp6-4w63-5g45 / CVE-2026-114612** (CVSS 9.9), lets a user escalate to proxy admin through cross-domain reuse of the salt key.

- **Severity** : Critical (CVSS 10.0)
- **Affected** : Before 1.103.10, 1.104.8, 1.105.6, 1.106.5 on their respective lines
- **Fixed** : 1.103.10, 1.104.8, 1.105.6, 1.106.5 (CVE-2026-114612: 1.100.4, 1.101.3, 1.102.2, 1.103.1)
- **Workaround** : At the edge, reject or strip POST bodies containing the JSON keys `standard_callback_dynamic_params`, `gcs_path_service_account`, `callbacks`, `success_callback` or `failure_callback`. Restrict the proxy’s outbound traffic to your LLM providers. Load the master key from a secret manager and set a separate `LITELLM_SALT_KEY`. If you were exposed, rotate the master key and provider keys.

**Reference** : [GHSA-w4c7-34wj-hqm8](https://github.com/BerriAI/litellm/security/advisories/GHSA-w4c7-34wj-hqm8) / [GHSA-7hp6-4w63-5g45](https://github.com/advisories/GHSA-7hp6-4w63-5g45)

* * *

### **4. Portainer: Standard Users Can Grab Host Bind Mounts (Docker Socket) via `volumes_from`**

**GHSA-j3mf-q9qf-5qf8** (no CVE assigned yet) | Disclosed: October 22, 2026  
**Project** : Portainer CE / BE

**Technical Details** : The “Hide bind mounts for non-administrators” check inspects a stack’s `volumes` but never `volumes_from`. A Standard user with access to a Docker environment can deploy a Compose stack that inherits the mounts of an existing container that has host bind mounts. On the documented Server and Agent setups, that includes the Docker socket and Portainer’s data directory, which means full control of the Docker host. Docker standalone is affected. Two Medium Portainer advisories came out the same day (GHSA-wc8m-r885-8pj3, GHSA-7423-r5wh-26x7).

- **Severity** : Critical (CVSS v4.0 9.4)
- **Affected** : 2.39.0 and later, through 2.45.2 (CE and BE)
- **Fixed** : 2.45.3. **The 2.39.x LTS line gets no patch** , and 2.40 – 2.44 are EOL. Move to 2.45.3.
- **Workaround** : Enable “Hide the use of Stacks for non-administrators” per environment. Only give Standard users environments where you’d trust them with host-level access. Audit existing non-admin stacks for `volumes_from`.

**Reference** : [GHSA-j3mf-q9qf-5qf8](https://github.com/portainer/portainer/security/advisories/GHSA-j3mf-q9qf-5qf8)

* * *

### **5. Outline: Account Takeovers via SSO/OAuth (36-Advisory Batch)**

**GHSA-48rq-wx9j-g949, GHSA-f28f-75h4-499q, GHSA-m9vh-j2wc-xj24** (no CVEs assigned yet) | Disclosed: October 24, 2026  
**Project** : Outline (wiki/knowledge base)

**Technical Details** : Outline published 36 advisories in one day (2 Critical, 11 High). The worst are login takeovers:

- **GHSA-48rq-wx9j-g949** : `userProvisioner` matches existing logins by `providerId` alone, but those IDs are only unique within one provider. A colliding ID from a different SSO/OIDC provider signs in as the existing user.
- **GHSA-f28f-75h4-499q** : With Azure SSO and `AZURE_TENANT_ID` unset (the default multi-tenant mode), an attacker sets the `mail` attribute in their own free Entra tenant to the victim’s address and signs in as the victim. No victim interaction.
- **GHSA-m9vh-j2wc-xj24** : The Azure and Discord adapters trust the provider’s `email` without checking its verified flag, then merge into the existing user. The attacker’s identity stays linked to the victim’s account.

The rest of the batch includes stored XSS (GHSA-w826-vphp-43r6, CVSS 8.7) and other High issues fixed in 1.9.0 – 1.12.0.

- **Severity** : Critical (GHSA-48rq, GHSA-f28f). The advisory text for GHSA-48rq gives CVSS 3.1 9.1; GHSA-f28f has no published score. GHSA-m9vh: High (CVSS 8.3)
- **Affected** : Before 1.11.0 (one High issue, GHSA-rq53-m97j-f2pg, before 1.12.0)
- **Fixed** : 1.12.0 covers the whole batch
- **Workaround** : If you use Azure SSO, set `AZURE_TENANT_ID` to your own tenant. Until patched, turn off the Discord and Azure providers if you don’t need them.

**Reference** : [Outline Security Advisories](https://github.com/outline/outline/security/advisories) / [GHSA-48rq-wx9j-g949](https://github.com/outline/outline/security/advisories/GHSA-48rq-wx9j-g949) / [GHSA-f28f-75h4-499q](https://github.com/outline/outline/security/advisories/GHSA-f28f-75h4-499q) / [GHSA-m9vh-j2wc-xj24](https://github.com/outline/outline/security/advisories/GHSA-m9vh-j2wc-xj24)

* * *

### **6. Atlantis: Forged Webhook → Fork-Protection Bypass → Remote Code Execution**

**GHSA-6mjf-4m52-m5cq** (no CVE assigned yet) | Disclosed: October 25, 2026  
**Project** : Atlantis (Terraform PR automation)

**Technical Details** : Atlantis checks the _path_ of a PR’s clone URL but not the _host_, and the fork check trusts the head repo name from the same webhook payload. An attacker can point Atlantis at their own git server and have it fetch and `plan` a Terraform tree they control. `--allow-fork-prs=false` sees a same-repo PR and lets it through, and the spoofed name also passes `--repo-allowlist`. **With no GitHub webhook secret set, one forged webhook is enough, unauthenticated.** It shipped with 11 more advisories (7 High), all fixed in the same release.

- **Severity** : Critical (CVSS 9.8)
- **Affected** : Before 0.49.0
- **Fixed** : 0.49.0
- **Workaround** : Configure a webhook secret now, and don’t expose the Atlantis events endpoint beyond your VCS provider’s IP ranges.

**Reference** : [GHSA-6mjf-4m52-m5cq](https://github.com/runatlantis/atlantis/security/advisories/GHSA-6mjf-4m52-m5cq) / [Atlantis Security Advisories](https://github.com/runatlantis/atlantis/security/advisories)

* * *

### **7. GLPI: Unauthenticated SQL Injection Plus 9 More High-Severity Fixes**

**GHSA-753w-2942-4pxm** (no CVE assigned yet) | Disclosed: October 26, 2026  
**Project** : GLPI (IT asset management / helpdesk)

**Technical Details** : An unauthenticated user can run a time-based SQL injection against the planning feature. The same release fixes nine other High issues, including two MFA bypasses (GHSA-3rr2-mxv6-rmc2, GHSA-rvrc-4jr9-wm5c), a malicious page upload (GHSA-pr87-h373-xr6c) and a marketplace race condition (GHSA-hv93-qr6v-7mpj).

- **Severity** : High (CVSS v4.0 8.7 for the SQLi; the batch ranges 7.5 – 8.9)
- **Affected** : SQLi: 11.0.8. Other issues reach back into 10.0.x and older (e.g. 9.3.0+ / 9.5.0+)
- **Fixed** : 11.0.9 (11.x), 10.0.27 (10.x)
- **Workaround** : Upgrade. Keep GLPI off the public internet or behind an authenticating proxy.

**Reference** : [GHSA-753w-2942-4pxm](https://github.com/glpi-project/glpi/security/advisories/GHSA-753w-2942-4pxm) / [GLPI Security Advisories](https://github.com/glpi-project/glpi/security/advisories)

* * *

### **8. n8n: Sandbox Escapes and Code Execution in the Main Process**

**GHSA-gx3v-3x3v-f8r5, GHSA-9p7v-45m2-wxgj, GHSA-f2cw-9483-7vcp** (no CVEs assigned yet) | Disclosed: October 28, 2026  
**Project** : n8n

**Technical Details** : A new batch of 12 advisories (3 High, 9 Medium), separate from last week’s:

- **GHSA-gx3v-3x3v-f8r5** : A user who can edit workflows can escape expression-evaluation isolation and run code on the host.

- **GHSA-9p7v-45m2-wxgj** : The deprecated Function / Function Item nodes (vm2) and the LangChain Code node run user code in the n8n main process, outside task-runner isolation. Fixed versions block these nodes by default. Existing workflows keep running, so replace them with the Code node. `N8N_DEPRECATED_NODES_BLOCK=false` brings the hole back.

- **GHSA-f2cw-9483-7vcp** : The GraphicsMagick bundled in the official Docker image has known bugs. Untrusted images fed to the Edit Image node can lead to RCE.

- **Severity** : High (CVSS v4.0 8.7 for GHSA-9p7v; 7.7 for the other two)

- **Affected** : Before 1.123.89, 2.45.5, 2.46.1, 3.0.1 (GHSA-9p7v: before 2.42.6, 2.43.3, 3.0.1)

- **Fixed** : 1.123.89, 2.45.5, 2.46.1, 3.0.1 (GHSA-9p7v also 2.42.6, 2.43.3)

- **Workaround** : Limit workflow editing to trusted users. Don’t wire an unauthenticated Webhook straight into an Edit Image node. Use `NODES_EXCLUDE` to drop nodes you don’t use.

**Reference** : [n8n Security Advisories](https://github.com/n8n-io/n8n/security/advisories) / [GHSA-gx3v-3x3v-f8r5](https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5) / [GHSA-9p7v-45m2-wxgj](https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj) / [GHSA-f2cw-9483-7vcp](https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp)

* * *

### **9. Nextcloud: Unauthenticated Persistent DoS via Federated Share Injection**

**CVE-2026-77167** | Disclosed: October 27, 2026  
**Project** : Nextcloud Server / Enterprise Server

**Technical Details** : An unauthenticated attacker can abuse the federated share endpoint to write arbitrary rows into `oc_share_external`. Nothing cleans those rows up. They trigger three separate denial-of-service conditions that renew themselves every 24 hours until the rows are removed. Nextcloud published 9 more Medium/Low advisories the same day.

- **Severity** : High (CVSS 7.5)
- **Affected** : Nextcloud Server before 34.0.2, 33.0.7, 32.0.13 (Enterprise back to 22.x)
- **Fixed** : Server 34.0.2, 33.0.7, 32.0.13. Enterprise also gets fixes back to 22.2.11 / 22.2.10.42 (see advisory)
- **Workaround** : Disable receiving federated shares.

**Reference** : [GHSA-5572-968j-v7g5](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5572-968j-v7g5)

* * *

### **10. FreshRSS 1.30.0: Login as Any User + PHP Object Injection**

**GHSA-8pvw-w7w8-vjj7, GHSA-rv9c-qhwg-9j55** (no CVEs assigned yet) | Disclosed: October 21 and October 24, 2026  
**Project** : FreshRSS

**Technical Details** :

- **GHSA-8pvw-w7w8-vjj7** (October 21, after last week’s cut-off): Form login calls `password_verify()` with the browser-supplied challenge as the _hash_ argument. Since PHP accepts legacy `crypt()` formats, an attacker can downgrade to DES and log in as any user without the password.
- **GHSA-rv9c-qhwg-9j55** (October 24): One feed kind has no `case` in `cacheFilename()`, so FreshRSS writes the raw downloaded page into SimplePie’s serialized `.spc` cache, which is later passed to `unserialize()`. Any user who can add a feed gets PHP object injection.

Two more High issues (GHSA-cgqh-mxr9-mx7h, GHSA-94h5-9h74-7c4q) are fixed in the same release.

- **Severity** : Critical (CVSS 9.8) for the auth bypass. High (CVSS 8.8) for the object injection
- **Affected** : Auth bypass: 1.11.0 – 1.29.1. Object injection: before 1.30.0
- **Fixed** : 1.30.0
- **Workaround** : Upgrade. Until then, use reverse-proxy/HTTP auth instead of form login, and don’t let untrusted users add feeds.

**Reference** : [GHSA-8pvw-w7w8-vjj7](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8pvw-w7w8-vjj7) / [GHSA-rv9c-qhwg-9j55](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-rv9c-qhwg-9j55)

* * *

## **Key Takeaways This Week**

- **Exploited first** : Node2Shell (Brotli) and Nextcloud’s built-in CODE server are on CISA’s KEV list. CISA also added last week’s PHP2Shell bugs (CVE-2026-109618/109619) to KEV on October 26, so if PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 isn’t on every box yet, do it today.
- **Rebuild images, not just apps** : Brotli lives inside Node.js and Python images. A `docker compose pull` only helps once upstream has rebuilt, so check the Node version inside the container.
- **SSO is only as good as its email check** : Outline trusted unverified Azure/Discord emails, and GitLab’s release (below) fixes an OmniAuth-to-LDAP account takeover. Pin your IdP tenant and check what your apps trust.
- **Least-privilege users aren’t least-privilege** : Portainer Standard users, n8n workflow editors and GLPI planning (no login at all) all lead to host or database access. Audit who has accounts.
- **Unsigned webhooks are an open door** : Atlantis with no webhook secret is unauthenticated RCE. Every webhook receiver you run should verify signatures.
- **AI/ML tooling is now a target** : LiteLLM, MLflow and Next.js-based AI frontends all had critical unauthenticated bugs. Don’t expose these to the internet without auth in front.
- **Already on Nginx UI 2.9.0?** Ten more advisories published October 22 (including `cert_sync` arbitrary conf writes) are all fixed in 2.9.0, the version we recommended last week. Grafana 12.4.14 / 13.2.5 / 13.3.0 (October 27) are Medium-only fixes. Discourse fixed an MCP private-message scope gap (CVSS 7.7) in 2026.10.0-latest.1 / 2026.9.1 / 2026.8.2 / 2026.7.4.

**Recommendation** : Review your self-hosted stack this weekend and prioritize upgrades for any of the above projects you’re running.

Stay secure!

_Questions or need config help? Post in Help ._

* * *

## **Missed Earlier**

These came out before this week and weren’t in an earlier summary. They’re all critical, unauthenticated and in widely self-hosted software.

### **11. GitLab CE/EE: Unauthenticated RCE in the Regular Expression Compiler (Back to 7.0)**

**CVE-2026-110264** | Disclosed: October 21, 2026  
**Project** : GitLab Community / Enterprise Edition

**Technical Details** : An integer overflow when compiling a crafted regular expression lets an unauthenticated user run code on the GitLab server. It affects every release since 7.0 (2014), and GitLab backported the fix to four older branches. GitLab has published two detection rules (“Onigmo native worker crash”, “Org mode render error burst”). The same release fixes CVE-2026-15723 (CVSS 8.2, OmniAuth SAML + LDAP auto-link account takeover) and CVE-2026-112212 (CVSS 7.5, OAuth/OIDC discovery cache poisoning). This is a different bug from the October 12 regex RCE (19.4.2) we covered earlier.

- **Severity** : Critical (CVSS 10.0)
- **Affected** : 7.0 – before 18.11.13, 19.0 \< 19.0.10, 19.1 \< 19.1.9, 19.2 \< 19.2.9, 19.3 \< 19.3.6, 19.4 \< 19.4.3, 19.5 \< 19.5.1
- **Fixed** : 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (19.5.2 followed on October 27)
- **Workaround** : None. Upgrade, then check logs against GitLab’s detection rules.

**Reference** : [GitLab Critical Patch Release 19.5.1](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) / [CERT-EU 2026-019](https://cert.europa.eu/publications/security-advisories/2026-019/)

* * *

### **12. Next.js: Two Unauthenticated RCEs (Image Optimization SVG + `use cache`)**

**CVE-2026-96889 (GHSA-2464-fhr4-w9xw), GHSA-673q-mjm6-r5xr** (no CVE yet for the second) | Disclosed: October 14, 2026  
**Project** : Next.js (Vercel). Used by many self-hosted dashboards and AI frontends

**Technical Details** :

- **GHSA-2464-fhr4-w9xw** : The Image Optimization API passes SVGs to `sharp`, whose memory bug on glibc Linux gives unauthenticated RCE.
- **GHSA-673q-mjm6-r5xr** : In App Router Cache Components, a `use cache` function that returns multiple typed arrays can be abused for unauthenticated RCE.

A third advisory (GHSA-p3m5-59mp-jv5r / CVE-2026-94482, High) is a Server Actions DoS.

- **Severity** : Critical (CVSS v4.0 9.5, both)
- **Affected** : SVG/sharp: 10.0.0 – 15.5.27 and 16.0.0 – 16.4.0. `use cache`: 16.0.0 – 16.4.0
- **Fixed** : 15.5.28, 16.4.1
- **Workaround** : For the SVG issue, make sure the resolved `sharp` is 0.35.5 or later (check your lockfile on 15.5.28). The `use cache` issue has no workaround.

**Reference** : [Next.js Security Update](https://nextjs.org/blog/nextjs-security-update-october-14-2026) / [GHSA-2464-fhr4-w9xw](https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw) / [GHSA-673q-mjm6-r5xr](https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr)

* * *

### **13. MLflow: Unauthenticated RCE via Third-Party Scorer Deserialization**

**CVE-2026-116692** | Disclosed: October 09, 2026 (added to the GitHub Advisory Database October 27)  
**Project** : MLflow

**Technical Details** : Since 3.12.0, the server imports a request-controlled module path when it deserializes a third-party scorer. Using MLflow’s own experiment, run and artifact-upload endpoints, an attacker uploads a Python module into an allowed package path and triggers it through `/ajax-api/3.0/mlflow/scorer/invoke`. On the default no-auth server, that is unauthenticated code execution. The official image runs as uid 0. Also fixed: CVE-2026-116690 (CVSS 7.5, file read).

- **Severity** : Critical (CVSS 9.8)
- **Affected** : 3.12.0rc0 – before 3.17.0
- **Fixed** : 3.17.0
- **Workaround** : Never expose an MLflow server without authentication in front of it, and don’t run it as root.

**Reference** : [GHSA-26p8-2jq9-3vq9](https://github.com/mlflow/mlflow/security/advisories/GHSA-26p8-2jq9-3vq9)

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [October 28, 2026, 2:33pm UTC](https://forum.hhf.technology/t/weekly-self-hosted-security-summary-october-22-october-28-2026/4606/2 "2026-10-28T14:33:55Z")

</div>