Conversation

Notices

1. Embed this notice
   PeerTube (peertube@framapiaf.org)'s status on Saturday, 23-May-2026 18:18:03 JST PeerTube

   **v8.1.8 Important security upgrade**

   We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.

   We released a new version that remove all user token access gained before v8.1.6. We also explain the attack in the changelog and the countermeasures taken by this release.

   **Please upgrade to v8.1.8 as soon as possible.**

   https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8

   • Embed this notice
     PeerTube (peertube@framapiaf.org)'s status on Saturday, 23-May-2026 18:39:57 JST PeerTube

     in reply to

     • John Livingston

     @John_Livingston All versions < 8.1.6 are vulnerable

   • Embed this notice
     John Livingston (john_livingston@mamot.fr)'s status on Saturday, 23-May-2026 18:39:59 JST John Livingston

     in reply to

     @peertube
     What is the first vulnerable version?

   • Embed this notice
     PeerTube (peertube@framapiaf.org)'s status on Saturday, 23-May-2026 19:23:00 JST PeerTube

     in reply to

     • GunChleoc

     @gunchleoc You can delete existing tokens on /admin/settings/system/runners/registration-tokens-list

     If you didn't enable remote runners, you don't need to do this.

   • Embed this notice
     GunChleoc (gunchleoc@mastodon.scot)'s status on Saturday, 23-May-2026 19:23:01 JST GunChleoc

     in reply to

     @peertube Updated, thanks!

     How do I "Generate new tokens for your runners"? Do I need to do this if I am not using any remote runners?

   • Embed this notice
     PeerTube (peertube@framapiaf.org)'s status on Tuesday, 26-May-2026 16:56:02 JST PeerTube

     in reply to

     • Тр3тий Сергеевич

     @th3rdsergeevich You can perform the mitigation steps if you can't upgrade for now (see the « If you cannot upgrade to v8.1.8 » section in the provided link).

   • Embed this notice
     Тр3тий Сергеевич (th3rdsergeevich@mastodon.ml)'s status on Tuesday, 26-May-2026 16:56:04 JST Тр3тий Сергеевич

     in reply to

     @peertube I'd be glad to update ASAP, but I can't install v8.1.x via Docker container because of "sharp" module (https://github.com/Chocobozzz/PeerTube/issues/7495).